Improper Access Control in light0011 CMS

The light0011 CMS, specifically targeting the Captcha Validation component within 'App/Home/Controller/UserController.class.php', contains a critical security vulnerability (CVE-2026-112025). This flaw originates from improper access control logic, which can be manipulated by remote, unauthenticated attackers. The vulnerability allows for the bypassing or manipulation of security checks intended to validate user identity or requests. Publicly available exploit code exists, increasing the risk of exploitation by malicious actors. As of the time of reporting, the project maintainers have not issued a patch or response to the reported issue. Organizations utilizing this CMS should consider the impact on user account security and internal access controls.

Impact

Successful exploitation allows remote attackers to bypass security checks associated with the Captcha Validation process. This potentially grants unauthorized access to restricted application functions or allows for the manipulation of user account actions, posing a significant risk to data integrity and session security within the affected CMS environment.

Recommendation

• Monitor web server access logs for anomalous POST or GET requests targeting 'App/Home/Controller/UserController.class.php'.
• Implement strict access control lists (ACLs) or Web Application Firewall (WAF) rules to restrict access to the CMS administrative and user management endpoints if feasible.
• Evaluate the exposure of the light0011 CMS instance to the public internet and restrict access to trusted source IP addresses until a vendor security update is available.