CVE-2026-85378

Received Received - Intake

Authorization Bypass in light0011 CMS Chapter Controller

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulDB

Description

A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function AuthController::_initialize of the file App/Admin/Controller/ChapterController.class.php of the component Chapter Controller. The manipulation leads to authorization bypass. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-03

Last Modified

2026-09-03

Generated

2026-09-04

AI Q&A

2026-09-04

EPSS Evaluated

N/A

NVD

CVE-2026-85378

Affected Vendors & Products

Vendor	Product	Version / Range
light0011	cms	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is an authorization bypass in light0011 CMS. It affects the AuthController::_initialize function in the Chapter Controller component. The flaw allows remote attackers to bypass authentication, potentially gaining unauthorized access to sensitive functions or data.

Detection Guidance

This vulnerability involves an authorization bypass in the light0011 CMS due to a flaw in the AuthController::_initialize function. To detect it, inspect the ChapterController.class.php file for improper access control logic. Check for publicly available exploits targeting this issue and monitor for unauthorized access attempts in logs.

Impact Analysis

An attacker could exploit this to gain unauthorized access to the CMS, modify content, steal data, or perform administrative actions without proper credentials. The public availability of the exploit increases the risk of real-world attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Immediately restrict access to the Chapter Controller component in light0011 CMS. Review and update authentication mechanisms to prevent authorization bypass. Monitor for unusual activity in the AuthController::_initialize function.

Hi! I’m here to help you understand CVE-2026-85378. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70