CVE-2026-86306: Improper Authentication in light0011 cms

This vulnerability in light0011 cms arises from improper authentication due to insufficient validation of the Username argument in the Cookie Helper component, specifically within App/Home/Model/UserModel.class.php. An attacker can remotely manipulate this argument to bypass authentication controls. The product's rolling release model means no fixed version information is provided. The issue was reported early to the project but remains unaddressed. A public exploit exists, increasing the risk of exploitation.

Successful exploitation allows remote attackers to bypass authentication mechanisms, potentially gaining unauthorized access to the system. This can lead to unauthorized actions within the CMS environment. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity), indicating a significant but not critical risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should monitor official channels for updates. In the meantime, consider restricting access to the affected component or implementing additional authentication controls if possible.