CVE-2026-86184

Lara Dashboard before 1.3.0 contains a missing-authentication flaw (CWE-306) in the screenshot-login route: the GET /screenshot-login/{email} endpoint issues a fully authenticated session to any unauthenticated caller who supplies a registered email address, with no password or token check. The bypass only applies when the application's APP_ENV is not set to production, so deployments running in non-production modes are the ones exposed. By impersonating any user whose email is known, an attacker gains access to user administration, application settings, and database contents, and can reach arbitrary code execution through the module installer. Any Lara Dashboard deployment on a version prior to 1.3.0 that runs outside production mode is affected, including staging and development instances reachable over the network. No public proof-of-concept or confirmed in-the-wild exploitation is known; EPSS currently assigns a 0.6% probability of exploitation within 30 days.

What to do: Upgrade to Lara Dashboard 1.3.0 or later. Until patched, ensure APP_ENV is set to production on any internet-reachable instance, or restrict/block the /screenshot-login route at the web server or network level for non-production deployments. Review user administration logs, settings, and installed modules for signs of unauthorized access or tampering, since successful impersonation can lead to code execution via the module installer.