Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route
cve-program · CVE-2026-86184
PublishedLara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APP_ENV is not production. Attackers can request the GET /screenshot-login/{email} endpoint with a registered email address to receive a fully authenticated session, enabling access to user administration, settings, database contents, and arbitrary code execution through the module installer.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-86184 · CVE overview and exploitation status
cve-program · CVE-2026-86184
- https://github.com/laradashboard/laradashboard/security/advisories/GHSA-wj35-4h53-phfp
- https://github.com/laradashboard/laradashboard/commit/50986e4ac58c883dd8f064cf32be3e2a87c11b24
- https://github.com/laradashboard/laradashboard/blob/v1.2.2/app/Http/Controllers/Backend/Auth/ScreenshotGeneratorLoginController.php
- https://github.com/laradashboard/laradashboard/releases/tag/v1.3.0
- https://github.com/laradashboard/laradashboard
- https://www.vulncheck.com/advisories/lara-dashboard-before-1.3.0-missing-authentication-in-screenshot-login-route
Related changes
Linked by CVE identifierNo related changes are available here.