CVE-2026-85381
Received Received - Intake

Authorization Bypass in light0011 CMS Chapter Controller

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulDB

Description
A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This issue affects some unknown processing of the file App/Home/Controller/ChapterController.class.php of the component Chapter Controller. Such manipulation of the argument content leads to authorization bypass. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85381
EUVD
EUVD-2026-70854

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
light0011 cms *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in a CMS application where unauthenticated users can access restricted content by manipulating article IDs. The issue occurs in the Chapter Controller due to improper enforcement of reader tier restrictions, allowing attackers to retrieve paid or private content without authentication.

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized access to restricted article endpoints. Check logs for requests to predictable endpoints with manipulated article IDs. Test by sending requests to public article endpoints with varying IDs to see if restricted content is returned without authentication.

Impact Analysis

Unauthorized users could access paid or restricted content without paying or meeting requirements. This may lead to financial losses for content providers, privacy breaches for sensitive data, and reduced trust in the platform's security measures.

Compliance Impact

This could violate data protection regulations like GDPR or HIPAA if unauthorized access exposes personal or sensitive information. Non-compliance may result in legal penalties, reputational damage, and loss of user trust due to improper access controls.

Mitigation Strategies

Implement server-side checks to verify user entitlements before returning restricted content. Ensure the CMS enforces reader tier restrictions on all article endpoints. Update the ChapterController.class.php and related files to validate access permissions server-side.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85381. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart