Authorization Bypass in light0011 CMS

A security vulnerability (CVE-2026-85378) exists in the light0011 CMS due to an authorization bypass flaw in the AuthController::_initialize function within the ChapterController component. This vulnerability allows remote, unauthenticated attackers to circumvent security controls, potentially granting unauthorized access to administrative functionality. The product utilizes a rolling release model without discrete versioning, and as of the reporting date, no patch or remediation update has been released by the project maintainers. Publicly available exploit code for this flaw increases the risk of immediate exploitation. Defenders should restrict network access to the administrative interfaces of this CMS while awaiting a vendor response.

Impact

Successful exploitation allows remote attackers to bypass authorization checks, potentially resulting in unauthorized administrative access, sensitive data exposure, or full system takeover. The vulnerability is publicly exploitable, placing any internet-facing instance of the light0011 CMS at immediate risk of compromise.

Recommendation

• Perform an inventory of all instances of light0011 CMS running within the organization.
• Restrict network access to the administrative management interfaces to authorized IP ranges only via firewall or WAF configuration.
• Monitor webserver logs for unauthorized POST or GET requests targeting the ChapterController component, specifically looking for attempts to reach admin functions without session authentication.
• Monitor the project repository for any future releases or security patches addressing this specific flaw.