CVE-2026-112026: light0011 cms UserModel.class.php sha1 weak password hash
A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected is the function sha1 of the file App/Home/Model/UserModel.class.php. The manipulation of the argument Password leads to password hash with insufficient computational effort. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What conditions make exploitation more likely?
An attacker can initiate the attack remotely without privileges or user interaction, but exploitation is assessed as high complexity and difficult. The weakness affects password handling through the Password argument in App/Home/Model/UserModel.class.php.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used, although the reported exploitability remains difficult.
What should teams do if no vendor response is available?
The project was notified through an issue report but has not responded. Review affected deployments for SHA-1 password hashing in App/Home/Model/UserModel.class.php and prioritize moving password storage to a stronger password-hashing mechanism.