CVE-2026-86184 in Lara Dashboard
Summary
by MITRE • 09/05/2026
Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APP_ENV is not production. Attackers can request the GET /screenshot-login/{email} endpoint with a registered email address to receive a fully authenticated session, enabling access to user administration, settings, database contents, and arbitrary code execution through the module installer.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/05/2026
The vulnerability identified in Lara Dashboard versions prior to 1.3.0 represents a critical authentication bypass flaw located within the screenshot-login route handler. This security defect allows unauthenticated actors to impersonate any registered user by simply providing their email address, effectively circumventing standard login mechanisms such as password verification or multi-factor authentication. The root cause of this issue lies in the application's environment-specific logic, where the protection measures are disabled when the APP_ENV configuration variable is set to a value other than production. In development, staging, or testing environments, which often retain debug features for convenience during software lifecycle management, the system erroneously grants full session access based solely on an email identifier without validating user credentials. This design oversight creates a significant attack surface where any individual with knowledge of a valid user's email address can gain unauthorized administrative privileges.
From a technical perspective, the exploitation vector involves sending a GET request to the /screenshot-login/{email} endpoint with a target username or email string as the path parameter. Upon receiving this request, the application logic bypasses standard authentication checks and immediately issues a session token associated with the specified user account. This behavior is particularly dangerous because it does not require any prior interaction from the victim user, such as clicking a phishing link or resetting a password. The attacker can directly assume the identity of high-privilege accounts, including administrators, thereby gaining unrestricted access to sensitive system components. Once authenticated through this bypass, an attacker can manipulate user administration panels, alter application settings, and extract confidential data stored in the database. Furthermore, the compromised session provides access to the module installer feature, which often executes code with elevated privileges, leading directly to arbitrary remote code execution on the host server.
The operational impact of this vulnerability is severe, extending beyond simple unauthorized access to potential full system compromise. By leveraging the authenticated session obtained via the email-based bypass, attackers can exfiltrate sensitive business data, modify critical configuration files, and install malicious modules that execute commands at the operating system level. This capability allows for complete control over the underlying infrastructure, facilitating further attacks such as lateral movement within a network or deployment of ransomware. The presence of this flaw in non-production environments is particularly concerning because development servers are frequently less hardened than production systems, often exposing internal services and debug interfaces that can be pivoted from to attack more critical assets. Additionally, if developers reuse credentials across environments, an attacker gaining access via the staging environment could potentially pivot to compromise the production system if similar vulnerabilities exist there or if credential hygiene is poor.
This vulnerability aligns with CWE-287, which describes Improper Authentication, as the application fails to adequately verify the identity of users attempting to gain access. It also maps closely to ATT&CK technique T1078, specifically Valid Accounts, where adversaries use legitimate credentials or authentication mechanisms inappropriately to maintain persistence and move laterally within a network environment. The specific mechanism of bypassing login through an email parameter reflects CWE-345, Insufficient Verification of Data Authenticity, as the system trusts user-supplied input without sufficient validation against authoritative identity sources. To mitigate this risk, developers must ensure that authentication checks are enforced consistently across all deployment environments and never disabled based on environment variables alone. Implementing strict access controls for administrative routes regardless of APP_ENV status is essential. Additionally, removing or restricting access to the screenshot-login route in any non-production setting where it serves no critical debugging purpose will eliminate this attack vector. Regular security audits and static code analysis should be employed to detect such logic flaws before deployment, ensuring that environment-specific configurations do not inadvertently weaken security postures.