CVE-2026-85381: Authorization Bypass in light0011 cms

This vulnerability in light0011 cms involves an authorization bypass caused by improper handling of an argument named 'content' in the Chapter Controller component's source file App/Home/Controller/ChapterController.class.php. An attacker can remotely exploit this flaw to bypass authorization mechanisms. The product is delivered via a rolling release process, so no specific version information is available for affected or patched releases. The vulnerability was responsibly disclosed to the project, which has not yet responded. The CVSS 4.0 vector indicates network attack vector, low complexity, no privileges or user interaction required, with low impact on confidentiality and no impact on integrity or availability.

Successful exploitation allows remote attackers to bypass authorization controls in the light0011 cms Chapter Controller component. This could lead to unauthorized access to functionality or data that should be restricted. The impact on confidentiality is low, and there is no impact on integrity or availability according to the CVSS vector. No known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, monitor the vendor's official channels for updates. Until a fix is available, consider restricting access to the affected component or implementing additional access controls as a temporary mitigation.