The vulnerability in LavaLite CMS versions 10.1.2 and earlier allows an authenticated user with low privileges to modify the accounts of other users, including administrators. By exploiting a flaw in the AbstractRequest isWorkflow() check, the attacker can issue a PATCH request to the user update route and change fields such as name, email, password, status, or mobile. This bypass removes normal authorization controls and permits unauthorized modifications of user credentials. The weakness corresponds to CWE-863.

Affected is LavaLite CMS up to and including version 10.1.2. The attack applies to installations that use the default framework configuration, which exposes the PATCH endpoint for user updates. The impact applies to all users of the system regardless of role once the low‑privileged account is authenticated.

The vulnerability carries a CVSS score of 7.1, indicating a high impact. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, suggesting limited public exploitation evidence. However, because it requires only authentication of a low‑privileged account, the attack surface is wide. If the software is deployed in environments where such accounts are not tightly restricted, an attacker could quickly raise privileges by changing administrative credentials or other user data. The absence of an available EPSS score means the likelihood cannot be quantified, but the potential damage warrants immediate attention.