The light0011 CMS contains a flaw in the sha1 hashing routine used for password storage. The hashing function uses a single round of SHA‑1, which requires insufficient computational effort and is vulnerable to brute‑force and dictionary attacks. Attackers who can obtain the stored hash can recover user credentials through offline cracking, compromising confidentiality of user accounts and potentially granting access to privileged services.

The vulnerability affects the light0011 CMS application. Specific version information is not disclosed in the available data; any deployment of light0011 CMS that incorporates the App/Home/Model/UserModel.class.php file is potentially impacted.

The CVSS score of 6.3 indicates a moderate severity flaw. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The description indicates that the attack vector is remote, however a high degree of complexity is required, and exploitability is considered difficult. Despite this, the use of a weak hash considerably lowers the barrier for credential compromise once an attacker has access to hash data.