Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to… (CVE-2026-86184)

CVE-2026-86184 is an authentication bypass vulnerability affecting Lara Dashboard versions prior to 1.3.0. The flaw exists in the screenshot-login route, which permits unauthenticated attackers to authenticate as any user by providing a registered email address when the APP_ENV environment variable is not set to production. Exploiting this vulnerability enables attackers to obtain fully authenticated sessions, thereby accessing sensitive administrative functions, database contents, and executing arbitrary code via the module installer component.

Successful exploitation results in complete compromise of the affected Lara Dashboard instance, including unauthorized access to user administration, configuration settings, database data, and arbitrary code execution. This can lead to full system takeover and data breach.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. As a temporary mitigation, ensure that the APP_ENV environment variable is set to 'production' in all deployments to prevent exploitation of the screenshot-login route. Monitor vendor channels for updates and apply official patches once available.