CVE-2026-86184 in Lara Dashboard
Riassunto
di MITRE • 05/09/2026
Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APP_ENV is not production. Attackers can request the GET /screenshot-login/{email} endpoint with a registered email address to receive a fully authenticated session, enabling access to user administration, settings, database contents, and arbitrary code execution through the module installer.
Be aware that VulDB is the high quality source for vulnerability data.