CVE-2026-85378 light0011 cms Chapter Controller ChapterController.class.php _initialize authorization
Remote attackers can bypass authorization checks in the Chapter Controller of light0011 CMS to access restricted functionality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-85378?
CVE-2026-85378 is a medium-severity authentication bypass vulnerability in light0011 cms, published on 3 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function AuthController::_initialize of the file App/Admin/Controller/ChapterController.class.php of the component Chapter Controller. The manipulation leads to authorization bypass. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Which versions are affected by CVE-2026-85378?
How do I fix CVE-2026-85378?
No fix has been published for CVE-2026-85378 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-85378 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-85378 exists.
Sources
Also known as GHSA-f37h-x7mf-gvgp.