Description
A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function AuthController::_initialize of the file App/Admin/Controller/ChapterController.class.php of the component Chapter Controller. The manipulation leads to authorization bypass. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-09-03
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Authorization Bypass leading to Privilege Escalation
Action: Assess Impact
AI Analysis

Impact

The vulnerability arises in the AuthController::_initialize method of ChapterController.class.php, allowing an attacker to manipulate input and bypass the authorization checks that normally restrict administrative actions. This results in the ability to perform privileged operations without proper authentication, effectively escalating privileges within the CMS.

Affected Systems

The affected product is light0011 CMS, specifically the Chapter Controller component located at App/Admin/Controller/ChapterController.class.php. No specific version information is available because the project uses continuous delivery with rolling releases, and the vendor has not issued a patch or updated releases yet.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate impact. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, but the exploit is reported to be publicly available and can be initiated remotely, suggesting that an attacker could readily target vulnerable installations.

Generated by OpenCVE AI on September 4, 2026 at 00:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest version of light0011 CMS that contains the authorization fix once it is released.
  • Use network-level controls to restrict administrative access to trusted IP ranges or VPNs, reducing the attack surface exposed to the public Internet.
  • Deploy a web application firewall or similar filtering layer to detect and block unauthorized requests that target the ChapterController initialization endpoint.

Generated by OpenCVE AI on September 4, 2026 at 00:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 03 Sep 2026 23:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function AuthController::_initialize of the file App/Admin/Controller/ChapterController.class.php of the component Chapter Controller. The manipulation leads to authorization bypass. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Title light0011 cms Chapter Controller ChapterController.class.php _initialize authorization
First Time appeared Light0011
Light0011 cms
Weaknesses CWE-285
CWE-639
CPEs cpe:2.3:a:light0011:cms:*:*:*:*:*:*:*:*
Vendors & Products Light0011
Light0011 cms
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Light0011 Cms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-11T20:38:03.542Z

Reserved: 2026-09-03T17:53:41.934Z

Link: CVE-2026-85378

cve-icon Vulnrichment

Updated: 2026-09-11T20:03:33.719Z

cve-icon NVD

Status : Deferred

Published: 2026-09-03T23:17:20.987

Modified: 2026-09-11T21:17:28.737

Link: CVE-2026-85378

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-04T15:20:48Z

Weaknesses
  • CWE-285

    Improper Authorization

  • CWE-639

    Authorization Bypass Through User-Controlled Key