CVE-2026-112026: Password Hash With Insufficient Computational Effort in light0011 cms

This vulnerability in light0011 cms involves the use of the sha1 hashing function for passwords with insufficient computational effort, reducing the effectiveness of password protection. The flaw is located in the UserModel.class.php file, specifically in the sha1 function handling password arguments. The attack vector is remote, but exploitation complexity is high. The vulnerability was reported early to the project, which has not yet issued a fix or response. No known exploits are currently active in the wild.

The impact is a reduced security level for password hashes due to weak computational effort, potentially enabling attackers to perform offline password cracking more easily if they obtain hashed passwords. However, the attack complexity is high and no privilege escalation or direct system compromise is described. No active exploitation in the wild is known at this time.

No official fix or patch is currently available from the vendor. Users should monitor the vendor advisory for updates. Until a fix is released, consider implementing additional protective measures such as enforcing strong passwords and using external mechanisms for password hashing if possible.