CVE-2026-86184: Lara Dashboard Auth Bypass Vulnerability

CVE-2026-86184 Overview

CVE-2026-86184 is an authentication bypass vulnerability in Lara Dashboard versions prior to 1.3.0. The flaw resides in the screenshot-login route, which allows unauthenticated attackers to authenticate as any registered user by supplying the target email in the URL. The route is only gated by an APP_ENV check for production, leaving staging, development, and misconfigured environments fully exposed. Successful exploitation grants attackers a fully authenticated session with access to user administration, application settings, database contents, and arbitrary code execution through the module installer. The vulnerability is classified under CWE-306: Missing Authentication for Critical Function.

Critical Impact
Unauthenticated attackers can hijack any account, including administrators, over the network and achieve remote code execution through the module installer.

Affected Products

Lara Dashboard versions prior to 1.3.0
Lara Dashboard v1.2.2 (confirmed vulnerable via source reference)
Deployments where APP_ENV is not set to production

Discovery Timeline

2026-09-05 - CVE-2026-86184 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86184

Vulnerability Analysis

The vulnerability lives in ScreenshotGeneratorLoginController::login($email), invoked by the GET /screenshot-login/{email} route. The controller performs exactly two operations: it aborts with HTTP 404 when App::environment('production') is true, then it calls Auth::login() on the user record matched by the supplied email. No token, signature, session challenge, or shared secret is verified. Any actor able to reach the route in a non-production environment can therefore assume the identity of any registered account by knowing or guessing an email address.

Once authenticated as an administrator, an attacker gains access to backend features that include user management, database inspection, and the module installer. The module installer enables uploading and executing new application modules, which converts the initial account takeover into arbitrary code execution on the host.

Root Cause

The root cause is missing authentication on a privileged administrative function ([CWE-306]). The developers relied on the APP_ENV environment variable as the sole boundary between a debug helper and production. Staging systems, QA environments, developer laptops exposed via tunneling, and misconfigured production deployments where APP_ENV is left as local or staging inherit no other protection. The vulnerable controller was removed entirely in the fix.

Attack Vector

Exploitation requires a single unauthenticated HTTP GET request to /screenshot-login/{email} where {email} is any registered account. The response is a redirect that establishes an authenticated session for that user. There is no user interaction, no authentication, and no complexity beyond identifying a valid email.

php

<?php
// Vulnerable controller removed in v1.3.0
// app/Http/Controllers/Backend/Auth/ScreenshotGeneratorLoginController.php

namespace App\Http\Controllers\Backend\Auth;

use App\Http\Controllers\Controller;
use App\Models\User;
use Illuminate\Http\RedirectResponse;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\App;

class ScreenshotGeneratorLoginController extends Controller
{
    public function login($email): RedirectResponse
    {
        // Only allow this functionality in non-production environments
        if (App::environment('production')) {
            abort(404, 'This functionality is not available in production environment');
        }

        // Find the user by email.
        $user = User::where('email', $email)->firstOrFail();

        // Authenticate the user and redirect.
        Auth::login($user);
        return redirect(request()->target ? request()->target : '/admin');
    }
}

Source: GitHub commit 50986e4a — the patch deletes the controller entirely, removing the route.

Detection Methods for CVE-2026-86184

Indicators of Compromise

HTTP GET requests to any URL matching the pattern /screenshot-login/* in web server or application logs.
Authenticated sessions for administrator accounts originating from IP addresses that never issued a POST to /login.
Unexpected use of the module installer, new module uploads, or file writes under the Lara Dashboard modules directory.
New or modified user records, role assignments, or permissions performed immediately after a screenshot-login request.

Detection Strategies

Search reverse proxy, load balancer, and application logs for the exact route screenshot-login across all environments, including staging and internal-only hosts.
Correlate successful admin logins with the absence of a preceding /login POST containing valid credentials.
Alert on any Lara Dashboard instance responding with HTTP 302 to GET /screenshot-login/{email} requests — the presence of the route indicates a vulnerable version.

Monitoring Recommendations

Inventory all Lara Dashboard deployments and record the installed version and the value of APP_ENV for each.
Monitor the module installer endpoints for uploads, and treat any upload that was not preceded by an interactive administrator session as suspicious.
Forward web server access logs and Laravel application logs to a centralized platform for retention and query.

How to Mitigate CVE-2026-86184

Immediate Actions Required

Upgrade Lara Dashboard to version 1.3.0 or later, which removes the vulnerable ScreenshotGeneratorLoginController and its route.
Audit all non-production deployments for the /screenshot-login/{email} route and treat any historical hits as potential compromise.
Rotate credentials, API tokens, and session secrets for any environment that exposed the route to untrusted networks.
Review recently installed modules and administrator changes for signs of exploitation.

Patch Information

The fix is delivered in Lara Dashboard v1.3.0. Commit 50986e4a removes the ScreenshotGeneratorLoginController entirely. Additional context is available in GitHub Security Advisory GHSA-wj35-4h53-phfp and the VulnCheck advisory.

Workarounds

If upgrading immediately is not possible, delete app/Http/Controllers/Backend/Auth/ScreenshotGeneratorLoginController.php and remove any route referencing screenshot-login from the route files.
Set APP_ENV=production on any exposed environment where the debug route is not required, understanding that this only closes the route and does not remove other latent debug behavior.
Restrict network access to non-production Lara Dashboard instances using firewall rules, VPN gating, or IP allowlisting so the route cannot be reached from the public internet.

bash

# Verify installed Lara Dashboard version and remove vulnerable route
grep -R "screenshot-login" routes/ app/Http/Controllers/Backend/Auth/

# Remove the vulnerable controller if upgrade is not yet possible
rm app/Http/Controllers/Backend/Auth/ScreenshotGeneratorLoginController.php

# Confirm environment is set to production on exposed hosts
grep '^APP_ENV=' .env