Description

Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APP_ENV is not production. Attackers can request the GET /screenshot-login/{email} endpoint with a registered email address to receive a fully authenticated session, enabling access to user administration, settings, database contents, and arbitrary code execution through the module installer.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-05T12:16:49.090Z",
  "pubdate": "2026-09-05T12:16:49.090Z",
  "executiveSummary": "Lara Dashboard versions prior to 1.3.0 are susceptible to a critical authentication bypass vulnerability located within the screenshot-login route.\nThe vulnerability occurs when the application environment is configured to a non-production state (APP_ENV != production), effectively disabling authentication guards for specific routes.\nUnauthenticated remote attackers can leverage this flaw to impersonate any registered system user by providing an arbitrary email address to the /screenshot-login/{email} endpoint.\nSuccessful exploitation results in full administrative session compromise, granting the attacker complete access to sensitive system functions, including database management, administrative settings, and the module installer.\nGiven the ability to use the module installer, an attacker can achieve arbitrary code execution on the underlying server, leading to a total system compromise.\nThis vulnerability represents a significant security risk, as it allows unauthorized access without any prior credentials or privilege requirements, provided the target environment is not set to production.",
  "technicalDetails": "The root cause of the vulnerability lies in an insecure implementation of a debugging or testing feature intended for development environments. The /screenshot-login/{email} route is defined in the application's routing logic with insufficient protection. While the developer intended for this route to be accessible only during local development, the logical check against the APP_ENV environment variable fails to strictly enforce production-only restrictions or adequately restrict access based on network origin or authentication state.\nWhen the application environment is configured to anything other than 'production', the application logic permits access to the screenshot-login controller. The controller accepts a dynamic {email} parameter directly from the HTTP request URI. It fails to perform any verification of the requester's identity, instead retrieving the user record associated with the provided email address directly from the underlying database.\nOnce the user object is retrieved, the application performs an automatic login, establishing a fully authenticated session for the attacker as the specified user. This occurs regardless of the attacker's actual authorization level or possession of valid credentials. Because the application logic treats this session as a legitimate login event, the attacker inherits all permissions associated with the targeted account, including administrative rights.\nThe attack flow is straightforward: 1) The attacker identifies a target application instance where the APP_ENV is set to a non-production value. 2) The attacker crafts an HTTP GET request to /screenshot-login/{email}, substituting '{email}' with the email address of an administrator or any other target user. 3) The server processes the request, locates the user, and initiates a session. 4) The attacker receives a session cookie or authentication token, allowing them to perform subsequent requests as the target user.\nPost-exploitation impact is severe. With an active administrative session, an attacker can interact with the user administration interface to escalate privileges, modify database configurations, or exfiltrate stored sensitive data. Furthermore, the ability to interact with the module installer enables the attacker to upload or execute malicious packages, facilitating arbitrary code execution (ACE) within the application context. This provides the attacker with full control over the application's filesystem and the ability to interact with the underlying host server."
}