CVE-2026-112026

Received Received - Intake

Weak SHA-1 Password Hashing in Light0011 CMS

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: VulDB

Description

A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected is the function sha1 of the file App/Home/Model/UserModel.class.php. The manipulation of the argument Password leads to password hash with insufficient computational effort. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-19

EPSS Evaluated

N/A

NVD

CVE-2026-112026

EUVD

EUVD-2026-104007

Affected Vendors & Products

Vendor	Product	Version / Range
light0011	cms	c774dce31c6df0055568a8d5c53d964d99be199d
light0011	cms	f72cf46f601efb2a0618c3814cc2f61380b38930

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-326	The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
CWE-916	The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

Attack-Flow Graph

Executive Summary

This vulnerability is in a CMS called light0011. It affects the SHA1 function in the UserModel.class.php file. The issue is that passwords are hashed with insufficient computational effort, making them easier to crack. The attack requires high complexity and is difficult to exploit but has been publicly disclosed.

Detection Guidance

This vulnerability involves weak password hashing in light0011 CMS due to the use of SHA1 with insufficient computational effort. To detect it, inspect the UserModel.class.php file for the sha1 function usage and verify if passwords are hashed with weak algorithms. Check for exposed user authentication endpoints or login forms in the CMS.

Impact Analysis

If exploited, attackers could crack weak password hashes and gain unauthorized access to user accounts. This could lead to data breaches, account takeovers, or further compromise of the CMS system. The impact depends on the sensitivity of the data stored.

Compliance Impact

This vulnerability may violate data protection regulations like GDPR or HIPAA, which require adequate security measures for protecting user data. Weak password hashing could lead to non-compliance, potential fines, or legal consequences if user data is compromised.

Mitigation Strategies

Update or patch the light0011 CMS to a version that addresses the weak SHA1 password hashing in UserModel.class.php. Disable remote access to the affected function if not required. Implement stronger password hashing algorithms like bcrypt or Argon2.

Hi! I’m here to help you understand CVE-2026-112026. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70