CVE-2026-85381: light0011 cms Chapter Controller ChapterController.class.php authorization
A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This issue affects some unknown processing of the file App/Home/Controller/ChapterController.class.php of the component Chapter Controller. Such manipulation of the argument content leads to authorization bypass. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
The attack can be launched remotely and requires no privileges or user interaction according to the supplied vector. Public exploit disclosure means attackers may be able to use available exploit information.
What component should be prioritized for investigation?
Investigation should focus on App/Home/Controller/ChapterController.class.php, specifically its handling of argument content in the Chapter Controller. The reported impact is an authorization bypass.
Are fixed versions available?
No affected or updated release versions are provided because the product uses a rolling-release model. The project was notified through an issue report but had not responded at the time of the report.