Authentication Bypass in Lara Dashboard Prior to 1.3.0

CVE-2026-86184

What is CVE-2026-86184?

Lara Dashboard versions prior to 1.3.0 are susceptible to an authentication bypass issue in the screenshot-login route. When the APP_ENV is set to non-production, attackers can exploit this vulnerability by requesting the GET /screenshot-login/{email} endpoint with a valid registered email address. This allows them to obtain a fully authenticated session without proper authorization, granting unrestricted access to user administration settings, database contents, and enabling arbitrary code execution via the module installer. To mitigate this risk, users are advised to update to version 1.3.0 or above.

References