CVE-2026-108951: LavaLite CMS through 10.1.2 Authorization Bypass via User Update API
LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow() check. Attackers can send a PATCH request to the user update route with a target identifier to change name, email, password, status, or mobile, including for administrators.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated user with low privileges can exploit it. The attacker does not need user interaction and can target other accounts, including administrator accounts.
What access and request capability does an attacker need?
The attacker needs valid authenticated access to LavaLite CMS and the ability to send a PATCH request to the user update route with the identifier of the account they want to modify.
What account data can be changed?
An attacker can modify another user's name, email address, password, status, or mobile number. Changing an administrator password or status could enable account takeover or administrative disruption.
Which versions are identified as affected?
LavaLite CMS through version 10.1.2 is identified as affected.