A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. (CVE-2026-85381)

CVE-2026-85381 is an authorization bypass vulnerability in the light0011 CMS affecting the Chapter Controller component, specifically the file App/Home/Controller/ChapterController.class.php. The flaw arises from improper processing of the content argument, enabling remote attackers to bypass authorization controls. The product operates on a rolling release basis, so no explicit version information is available. The vulnerability has been publicly disclosed, but the project has not yet issued a fix or response. The CVSS 3.1 base score is 5.3 (medium severity), with an attack vector of network, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact.

An attacker can remotely bypass authorization controls by manipulating input to the Chapter Controller component, potentially gaining unauthorized access to restricted functionality or data. The confidentiality impact is limited, and there is no impact on integrity or availability. No active exploitation in the wild is currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or issued a fix, users should monitor official channels for updates. Until a fix is available, consider restricting access to the vulnerable component or applying compensating controls to limit exposure.