The vulnerability allows an unauthenticated attacker to authenticate as any user by requesting the GET /screenshot-login/{email} endpoint when the application environment is not production. The attacker receives a fully authenticated session, granting access to user administration, settings, database content, and the ability to execute arbitrary code through the module installer.

Laradashboard’s Laradashboard application prior to version 1.3.0 is affected. Any installation that has not been upgraded to 1.3.0 or later exposes the screenshot-login route and is therefore vulnerable.

The CVSS score of 9.3 indicates critical severity, and the exploitation can be performed over the network without any credentials or special conditions beyond the application being in a non-production environment. The EPSS score is not available, but the lack of a KEV listing does not reduce the seriousness of the threat; the attack vector is a simple HTTP GET request to a publicly accessible endpoint.