EUVD-2026-71993
GHSA-f9pj-h2mm-qw99
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network, unauthenticated, no interaction, but gated on a non-default APP_ENV!=production condition outside attacker control (AC:H); RCE via module installer yields full C/I/A impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APP_ENV is not production. Attackers can request the GET /screenshot-login/{email} endpoint with a registered email address to receive a fully authenticated session, enabling access to user administration, settings, database contents, and arbitrary code execution through the module installer.
AnalysisAI
Authentication bypass in Lara Dashboard before 1.3.0 lets unauthenticated attackers log in as any registered user by requesting GET /screenshot-login/{email}, provided the deployment runs with APP_ENV set to anything other than production. The route was a demo-screenshot helper (used by an internal Browsershot command with superadmin@example.com) that was reachable in non-production environments, granting a fully authenticated session that reaches user administration, settings, database contents, and arbitrary code execution via the module installer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target Lara Dashboard (before 1.3.0) to be running with APP_ENV set to any value other than 'production' (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H) reflects unauthenticated network-reachable full compromise culminating in RCE through the module installer, which is a genuinely severe chain. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Lara Dashboard v1.3.0 (release https://github.com/laradashboard/laradashboard/releases/tag/v1.3.0), which removes the screenshot-login route and the associated GenerateScreenshots command (commit https://github.com/laradashboard/laradashboard/commit/50986e4ac58c883dd8f064cf32be3e2a87c11b24). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Lara Dashboard deployments and confirm their APP_ENV configuration; isolate any instances running with APP_ENV set to a value other than 'production' and restrict network access until patching is complete. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Laradashboard
View allLaraDashboard is an all-In-one solution to start a Laravel Application. In 2.3.0 and earlier, the password reset flow tr
Server-side request forgery in Lara Dashboard 0.9.2-1.3.1 allows any authenticated content editor to proxy arbitrary HTT
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today