CVE-2025-70866: High severity Lavalite LavaLite CMS vulnerability

Published Feb 13, 2026

Updated

LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticated user with low-level privileges (User role) can directly access the admin backend by logging in through /admin/login. The vulnerability exists because the admin and user authentication guards share the same user provider without role-based access control verification.

Affected Software

2 affected components

Lavalite LavaLite CMS

Lavalite LavaLite=10.1.0

Event History

Feb 13, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·10:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-70866?

CVE-2025-70866 is considered a critical vulnerability due to incorrect access controls allowing unauthorized access to the admin backend.

How do I fix CVE-2025-70866?

To fix CVE-2025-70866, update your LavaLite CMS to the latest version which addresses the access control issues.

Who is affected by CVE-2025-70866?

CVE-2025-70866 affects users of LavaLite CMS version 10.1.0, particularly those with low-level user privileges.

What type of vulnerability is CVE-2025-70866?

CVE-2025-70866 is categorized as an Incorrect Access Control vulnerability.

Can I exploit CVE-2025-70866 without special privileges?

Yes, an authenticated user with low-level privileges can exploit CVE-2025-70866 to gain unauthorized access to the admin backend.