CVE-2026-86184

Name of the Vulnerable Software and Affected Versions Lara Dashboard versions prior to 1.3.0

Description An authentication bypass exists in the screenshot-login route when the APP ENV variable is not set to production. Unauthenticated attackers can access the GET '/screenshot-login/{email}' endpoint using a registered email address to obtain a fully authenticated session. This allows unauthorized access to user administration, settings, and database contents, as well as arbitrary code execution via the module installer.

Recommendations Update Lara Dashboard to version 1.3.0 or later. Set the APP ENV variable to production to prevent the authentication bypass.