The vulnerability in light0011 CMS allows an attacker to forge HTTP requests on behalf of an authenticated user. By manipulating request parameters, a remote adversary can cause the CMS to perform arbitrary state‑changing actions without the victim’s knowledge. This is a classic Cross‑Site Request Forgery flaw identified by CWE‑352 and is further amplified by broken access control (CWE‑862), potentially enabling the execution of privileged operations if the authenticated session belongs to an admin user.

All installations of the light0011 CMS are potentially affected, regardless of version, because the project follows a rolling release model and does not publish fixed‑version identifiers. The vulnerability originates from code paths that are not version‑specific and therefore any current deployment of the CMS is in scope. No specific release or build numbers can be listed due to the absence of versioned tags in the repository.

The CVSS score of 5.3 indicates a moderate severity. EPSS information is unavailable, and the vulnerability is not listed in CISA KEV, which suggests that, while the flaw is exploitable, it has not yet been widely abused in the wild. The attack vector is remote; an attacker can exploit it by sending crafted HTTP requests to a victim’s browser session, potentially using social engineering or compromise of a trusted user's credentials. The risk to confidentiality is low, but integrity and availability may be compromised if privileged actions are performed.