Description

A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function AuthController::_initialize of the file App/Admin/Controller/ChapterController.class.php of the component Chapter Controller. The manipulation leads to authorization bypass. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-03T23:17:20.987Z",
  "pubdate": "2026-09-03T23:17:20.987Z",
  "executiveSummary": "A critical authorization bypass vulnerability exists within the light0011 CMS, specifically affecting the Chapter Controller component.\nThe vulnerability resides in the AuthController::_initialize function, which is responsible for enforcing access control logic.\nFailure to correctly validate user sessions or authorization tokens allows unauthenticated remote attackers to bypass security restrictions.\nSuccessful exploitation grants unauthorized access to administrative or restricted functions within the ChapterController.class.php file, leading to potential unauthorized data modification or administrative command execution.\nThe vulnerability is currently unpatched, with no formal versioning information available due to a rolling release delivery model.\nThe existence of public exploit code increases the risk of active exploitation by malicious actors.\nOrganizations utilizing this CMS are at high risk of unauthorized system access and should implement compensatory controls immediately.",
  "technicalDetails": "The vulnerability is located in the App/Admin/Controller/ChapterController.class.php file within the AuthController::_initialize function. In the architecture of this CMS, the _initialize method typically serves as a constructor-level hook that executes before any action method is invoked. This design pattern is intended to enforce authentication and authorization checks globally for administrative controllers.\nThe root cause of this vulnerability is an insufficient or flawed implementation of the access control check within the _initialize function. It appears that the authorization logic fails to properly terminate the execution flow when a session is missing or invalid, or it relies on client-controlled input that can be easily manipulated. By failing to force an exit or redirect upon authentication failure, the execution continues into the requested action method despite the absence of valid credentials.\nThe attack flow initiates with a remote attacker crafting HTTP requests directed at the Chapter Controller endpoints. Since the _initialize function does not effectively gate access, the application treats the unauthenticated request as a legitimate, authorized call. An attacker can target specific administrative endpoints defined within ChapterController.class.php, bypassing the security interceptor entirely.\nBecause the system utilizes continuous delivery, the vulnerable codebase lacks specific version tags, though it is linked to commit hashes c774dce31c6df0055568a8d5c53d964d99be199d and f72cf46f601efb2a0618c3814cc2f61380b38930. The exploitation does not require prior authentication, making it a critical threat to the confidentiality and integrity of the application. The post-exploitation impact includes the ability to perform administrative actions, potentially leading to unauthorized data manipulation or further system compromise depending on the available functions within the Chapter Controller.\nThe vulnerability is exposed via the network, allowing remote attackers to trigger the bypass without local access. Given the existence of public exploit material, attackers are likely targeting these specific endpoints to gain unauthorized access to administrative workflows."
}