CVE-2026-108951
6.5MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-863
Impact
Authenticated low-privileged users can take over administrator accounts by modifying credentials, contact details, or account status. Attackers only need network access and a valid low-privilege login.
Root cause
Flawed authorization checks in the AbstractRequest isWorkflow() method fail to properly restrict PATCH requests sent to the user update endpoint.
Affected systems
LavaLite CMS through 10.1.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Fix & remediation
No fixed version is specified in the advisory; block or restrict PATCH requests to the user update API route at the reverse proxy or WAF until a patch is released.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow() check. Attackers can send a PATCH request to the user update route with a target identifier to change name, email, password, status, or mobile, including for administrators.
References
- https://github.com/LavaLite/cms
- https://github.com/LavaLite/cms/issues/431
- https://github.com/LavaLite/framework/blob/a06cba09da27087b2013035c38c536491e4f83ad/src/Litepie/Http/Request/AbstractRequest.php#L62-L70
- https://github.com/LavaLite/framework/blob/a06cba09da27087b2013035c38c536491e4f83ad/src/Litepie/User/config/user.php#L515
- https://www.vulncheck.com/advisories/lavalite-cms-through-10.1.2-authorization-bypass-via-user-update-api