CVE-2026-112025

Received Received - Intake

Improper Access Control in light0011 CMS

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: VulDB

Description

A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This impacts an unknown function of the file App/Home/Controller/UserController.class.php of the component Captcha Validation. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-19

EPSS Evaluated

N/A

NVD

CVE-2026-112025

EUVD

EUVD-2026-104006

Affected Vendors & Products

Vendor	Product	Version / Range
light0011	cms	c774dce31c6df0055568a8d5c53d964d99be199d
light0011	cms	f72cf46f601efb2a0618c3814cc2f61380b38930

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper access control issue in light0011 CMS, specifically in the Captcha Validation component of UserController.class.php. A remote attacker can manipulate the system due to missing or weak access controls, potentially gaining unauthorized access or performing actions beyond their permissions. The exploit has been publicly disclosed and could be actively used in attacks.

Detection Guidance

To detect this vulnerability, inspect the file App/Home/Controller/UserController.class.php in light0011 CMS for improper access control mechanisms. Check for exposed CAPTCHA validation endpoints that may allow unauthorized manipulation. Review server logs for unusual access patterns or requests targeting CAPTCHA-related functions.

Impact Analysis

If you use the affected light0011 CMS version, attackers could bypass security measures, access sensitive data, or perform unauthorized actions. The public availability of the exploit increases the risk of real-world attacks. Immediate patching or mitigation is recommended to prevent potential breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Non-compliance may result in legal penalties, fines, or reputational damage. Organizations must address this flaw to maintain regulatory adherence.

Mitigation Strategies

Immediately update light0011 CMS to the latest patched version if available. If no patch exists, disable the affected CAPTCHA validation component in UserController.class.php. Implement strict input validation for CAPTCHA-related endpoints and restrict access to sensitive functions. Monitor network traffic for exploit attempts targeting this weakness.

Hi! I’m here to help you understand CVE-2026-112025. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70