CVE-2026-112025
7.3HighPublished 18 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-266, CWE-284
Impact
Remote, unauthenticated attackers can bypass access controls by manipulating captcha validation. Public exploit code is already available.
Root cause
Improper access control logic within captcha verification in UserController.class.php allows validation bypass.
Affected systems
light0011 cms commit c774dce31c6df0055568a8d5c53d964d99be199d and commit f72cf46f601efb2a0618c3814cc2f61380b38930.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
No official patch exists yet; restrict network access to the application or implement a WAF rule blocking external requests to UserController endpoints.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This impacts an unknown function of the file App/Home/Controller/UserController.class.php of the component Captcha Validation. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.