CVE-2026-85378
A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function AuthController::_initialize of the file App/Admin/Controller/ChapterController.class.php of the component Chapter Controller. The manipulation leads to authorization bypass. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 7.5
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
- EPSS probability
- 0.30%
- CWE
- CWE-639, CWE-285
- Published
- 2026-09-03
- Last modified
- 2026-09-03
Affected products
- light0011 cms
- light0011 cms
Weakness type
Related vulnerabilities
- CVE-2026-80354 — Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespace
- CVE-2026-82582 — An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may...
- CVE-2026-84062 — BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through...
- CVE-2026-87997 — Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions
- CVE-2026-87994 — Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint
- CVE-2026-47156 — MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator
- CVE-2026-67403 — Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API....
- CVE-2026-86763 — snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer