A weakness in the Captcha Validation logic of light0011 cms allows an attacker to manipulate requests to the UserController endpoint so that access checks are bypassed. This can lead to unauthorized actions being performed on the system, potentially granting an attacker elevated privileges. The impact includes violation of confidentiality, integrity, and availability if the affected operations modify or expose sensitive data.

The vulnerability affects the light0011 cms platform. No specific product versions were disclosed, so all releases containing the App/Home/Controller/UserController.class.php file are potentially affected. The project has been notified but has not yet released a patch.

The CVSS score of 6.9 indicates a moderate level of severity. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Because the attack vector is remote and publicly documented exploits are available, the likelihood of exploitation is significant. The flaw is a straightforward improper access control, making it exploitable without special prerequisites.