CVE-2026-86184: Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route
Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APPENV is not production. Attackers can request the GET /screenshot-login/{email} endpoint with a registered email address to receive a fully authenticated session, enabling access to user administration, settings, database contents, and arbitrary code execution through the module installer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lara Dashboardto a version that resolves this vulnerability.Fixed in 1.3.0 - Configuration
Ensure APP_ENV is set to production to prevent the authentication bypass in the /screenshot-login/{email} route.
Lara Dashboard APP_ENV = production
Event History
Frequently Asked Questions
Which deployments are exposed?
Lara Dashboard versions before 1.3.0 are exposed when APP_ENV is set to anything other than production. The vulnerable route is reachable at GET /screenshot-login/{email}.
What does an attacker need to exploit this issue?
An attacker needs network access to the affected Lara Dashboard instance and the email address of a registered user. No authentication or user interaction is required.
What level of access can exploitation provide?
Successful exploitation creates a fully authenticated session as the selected user. This can provide access to user administration, settings, database contents, and arbitrary code execution through the module installer.
How can I determine whether an instance may already be vulnerable?
Check whether the installation is running a version before 1.3.0 and whether APP_ENV is not set to production. Also determine whether the screenshot-login endpoint is accessible and whether registered user email addresses could be used against it.