Lara Dashboard — CVE-2026-86184 (Critical)

Date Sep 5, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Lara · Dashboard

CVE CVE-2026-86184

Critical vendor advisory CVE-2026-86184

Summary

Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APP_ENV is not production. Attackers can request the GET /screenshot-login/{email} endpoint with a registered email address to receive a fully authenticated session, enabling access to user administration, settings, database contents, and arbitrary code execution through the module installer.

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.8) in Lara Dashboard. Patch or mitigate promptly. EPSS percentile: 46%.

Operator check

Review CVE-2026-86184 in your asset inventory. Apply patches per vendor guidance and verify Dashboard is not exposed. CVSS score: 9.8. EPSS probability: 0.6%; percentile: 46%.

Sources

NVD — CVE-2026-86184 Source reference Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed