CVE-2026-86184Disclosure

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APP_ENV is not production. Attackers can request the GET /screenshot-login/{email} endpoint with a registered email address to receive a fully authenticated session, enabling access to user administration, settings, database contents, and arbitrary code execution through the module installer.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-306

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-09-05); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets1 URL

By indicator

https://www.cve.org/CVERecord?id=CVE-2026-86184

Full discourse2 posts

Rıdvan Yağlı@ridvanyagli45d
Disclosure
🔴 Laravel tabanlı Lara Dashboard'da kritik bir Authentication Bypass açığı tespit edildi. CVSS skor: 9.8 Critical (CVE-2026-86184) 1.3.0 öncesi sürümler, APP_ENV değeri production olarak ayarlanmamışsa saldırganların yalnızca kayıtlı bir kullanıcının e-posta adresini bilerek o kullanıcı adına kimlik doğrulamasını mümkün kılıyor. Başarılı istismar sonucunda: Hesap ele geçirme Kullanıcı yönetimine erişim Uygulama ayarlarına erişim Veritabanı içeriğine erişim Potansiyel RCE etkileri ortaya çıkabiliyor. Çözüm: Lara Dashboard'u 1.3.0 veya üzerine güncelleyin. Ek olarak internet'e açık sistemlerde .env içerisindeki APP_ENV=production ayarını kontrol edin.
Post summary
A critical authentication bypass in Lara Dashboard (CVE-2026-86184) allows attackers to gain broad access; patching to 1.3.0 or ensuring APP_ENV=production is advised.
09037233.5K
2.4K followersView on X
CVE@CVEnew46d
Disclosure
CVE-2026-86184 Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any… https://www.cve.org/CVERecord?id=CVE-2026-86184
Post summary
The tweet announces a CVE‑2026‑86184 authentication‑bypass vulnerability in Lara Dashboard versions before 1.3.0, detailing how unauthenticated attackers can impersonate any user.
000001.1K
58.1K followersView on X

Explore more

Back to dashboard