CyberRota Analysis
AI-GeneratedLara Dashboard versions prior to 1.3.0 are vulnerable to an authentication bypass that allows unauthenticated attackers to gain access to user accounts by exploiting the screenshot-login route when the application environment is not set to production. This critical vulnerability can lead to unauthorized access to user administration, sensitive settings, and potential arbitrary code execution. Organizations using Lara Dashboard should prioritize immediate updates to version 1.3.0 or later to mitigate this severe risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APP_ENV is not production. Attackers can request the GET /screenshot-login/{email} endpoint with a registered email address to receive a fully authenticated session, enabling access to user administration, settings, database contents, and arbitrary code execution through the module installer.