Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-85378

light0011 cms Chapter Controller ChapterController.class.php _initialize authorization

CVSS 4.0 6.9 MEDIUMCVSS 3.1 7.3 HIGHCVSS 3.0 7.3 HIGHCVSS 2.0 7.5 Check source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-85378

Published

A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function AuthController::_initialize of the file App/Admin/Controller/ChapterController.class.php of the component Chapter Controller. The manipulation leads to authorization bypass. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-85378

Published

cms

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "light0011",
                    "product": "cms",
                    "versions": [
                        {
                            "version": "c774dce31c6df0055568a8d5c53d964d99be199d",
                            "status": "affected"
                        },
                        {
                            "version": "f72cf46f601efb2a0618c3814cc2f61380b38930",
                            "status": "affected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:light0011:cms:*:*:*:*:*:*:*:*"
                    ],
                    "modules": [
                        "Chapter Controller"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON