A missing authentication check in Lara Dashboard versions before 1.3.0 can let an unauthenticated attacker log in as any registered user by requesting a URL containing that user's email address; on deployments where APP_ENV is set to anything other than production.
What Is It
Lara Dashboard ships a screenshot-login route intended for automated screenshot generation. In versions before 1.3.0, that route performs no authentication. When APP_ENV is set to anything other than production, an attacker can send GET /screenshot-login/{email} with a known registered email address and receive a fully authenticated session as that user.
The flaw is classified as CWE-306 (Missing Authentication for Critical Function). It carries a CVSS v3.1 base score of 9.8 (CRITICAL, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CVSS v4.0 score of 9.3 (CRITICAL), both assigned by VulnCheck.
Why It Matters
There is no exploit chain to build here; the attack is a single unauthenticated HTTP GET request over the network, requiring no privileges and no user interaction. The only prerequisites are network reach and a valid email address for an account on the target.
The session an attacker receives is scoped to whichever account they name, so the resulting access tracks that account's privileges. Targeting an administrator is what makes the outcome severe: per the advisory, an attacker in that position gains access to user administration, application settings, and database contents, and can achieve arbitrary code execution through the module installer. Administrator email addresses are frequently guessable or publicly discoverable, so an attacker generally does not have to settle for a low-privileged account.
The APP_ENV condition is a weak safeguard in practice: staging, development, and misconfigured deployments routinely run with a non-production environment value while still exposing real data and real accounts.
What's Vulnerable
- Vendor / product: laradashboard; Lara Dashboard (
pkg:github/laradashboard/laradashboard) - Affected versions: all versions before 1.3.0
- Fixed version: 1.3.0 and later
- Condition: exploitable when
APP_ENVis not set toproduction - Affected component:
app/Http/Controllers/Backend/Auth/ScreenshotGeneratorLoginController.php
The supplied source material contains no CISA KEV entry for this CVE, so there is no confirmation of active exploitation and no federal remediation deadline at this time.
Patch Status
A fix is available. Upgrade to Lara Dashboard 1.3.0, released with commit 50986e4ac58c883dd8f064cf32be3e2a87c11b24. Operators unable to patch immediately should verify that APP_ENV is set to production in every deployed environment, as the vulnerable path is gated on that value. NVD lists the record as Received (published 2026-09-05), so analysis may still change.