CVE-2026-85378: Authorization Bypass in light0011 cms

The vulnerability identified as CVE-2026-85378 affects the AuthController::_initialize function within the Chapter Controller component of the light0011 CMS, specifically in the file App/Admin/Controller/ChapterController.class.php. This flaw allows an attacker to bypass authorization controls remotely. The vulnerability is classified under CWE-285 (Improper Authorization). Exploit code is publicly available, indicating potential risk, though no known exploits in the wild have been reported. Due to the product's continuous delivery model with rolling releases, no explicit affected versions or patches have been disclosed. The vendor has been notified but has not yet provided a response or remediation.

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to bypass authorization mechanisms, potentially leading to unauthorized access with limited confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). This could enable attackers to perform actions restricted to authorized users within the affected CMS component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patches are available, monitor official channels for updates. In the meantime, consider restricting access to the affected component or applying compensating controls to limit exposure.