CVE-2026-85378: Authorization Bypass in light0011 cms

This vulnerability exists in the AuthController::_initialize function of the Chapter Controller component in light0011 cms. It allows an attacker to bypass authorization mechanisms remotely, potentially granting unauthorized access. The vulnerability was reported early to the project, but no response or patch has been provided. Due to the product's continuous delivery model, no specific affected or patched versions are identified. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low to low impact on confidentiality, integrity, and availability.

An attacker can remotely bypass authorization controls in the affected component, potentially gaining unauthorized access to restricted functions or data within the CMS. The impact is rated medium based on the CVSS score of 6.9, reflecting limited but significant risk due to the lack of required privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. Until a fix is available, consider restricting network access to the affected component or applying compensating controls to limit exposure.