Authentication Bypass in Lara Dashboard

Lara Dashboard versions prior to 1.3.0 contain an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by specifying their email address. This vulnerability is active when the application environment (APP_ENV) is configured to anything other than 'production'. By sending a crafted GET request to the /screenshot-login/{email} endpoint, an unauthenticated attacker can obtain a fully authenticated session for the specified user account. This provides the attacker with immediate access to sensitive system administration panels, application settings, and database contents. Furthermore, the elevated access granted by this bypass allows for the use of the module installer to execute arbitrary code on the underlying server, presenting a significant risk to organizational infrastructure.

Impact

Successful exploitation allows for full account takeover of any user, including administrative accounts. Attackers can leverage this access to exfiltrate sensitive data from the database, modify system configurations, and achieve remote code execution via legitimate management modules. This vulnerability exposes the entire application instance to total compromise.

Recommendation

• Upgrade Lara Dashboard to version 1.3.0 or later immediately to resolve CVE-2026-86184.
• Ensure the production application environment is explicitly set to 'production' (APP_ENV=production) in all deployment configurations to disable the vulnerable debug/development route.
• Audit access logs for unauthorized GET requests to the /screenshot-login/ path, especially those originating from external or untrusted network segments.