Description

A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This issue affects some unknown processing of the file App/Home/Controller/ChapterController.class.php of the component Chapter Controller. Such manipulation of the argument content leads to authorization bypass. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-04T01:17:22.883Z",
  "pubdate": "2026-09-04T01:17:22.883Z",
  "executiveSummary": "A critical authorization bypass vulnerability exists within the Chapter Controller component of the light0011 CMS, specifically affecting the processing logic in App/Home/Controller/ChapterController.class.php.\nThis vulnerability allows a remote, unauthenticated attacker to manipulate the 'content' argument, leading to unauthorized access or modification of protected chapter resources.\nThe vulnerability stems from improper validation of input parameters, which fail to enforce security constraints or access controls before processing requests.\nThe risk is high, as the exploit is publicly disclosed, potentially allowing attackers to gain unauthorized access to restricted system functionality.\nAs the product utilizes a rolling release model without specific versioning, all instances currently running the identified codebase commit (c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930) are considered vulnerable.\nSuccessful exploitation allows an attacker to bypass authorization mechanisms remotely, potentially leading to unauthorized data exposure, modification, or other integrity-related impacts within the application context.",
  "technicalDetails": "The vulnerability is located within the Chapter Controller component of light0011 CMS, specifically in the App/Home/Controller/ChapterController.class.php file. The root cause is a failure in the application's input sanitization and authorization enforcement mechanisms when handling the 'content' argument during request processing.\nThe application processes requests through the Chapter Controller, which appears to trust the 'content' input without adequately verifying the user's authorization level or the legitimacy of the request. By crafting a specifically engineered payload passed via this argument, an attacker can manipulate the internal state or the flow of execution within the controller.\nAn attacker can exploit this vulnerability remotely without requiring prior authentication. The attack flow involves the attacker sending an HTTP request (GET or POST, depending on the implementation) to the endpoint handled by App/Home/Controller/ChapterController.class.php. The attacker includes a malicious value in the 'content' argument that is designed to subvert the expected control flow.\nUpon receiving the malicious request, the controller parses the 'content' argument. Due to the lack of sufficient authorization checks in the processing logic, the application proceeds to execute operations or access resources that should be restricted based on the attacker's context (which is effectively unprivileged or null). The improper handling of this argument facilitates an authorization bypass, allowing the attacker to perform actions they are not authorized to execute.\nThis vulnerability is particularly severe because the exploit code has been publicly disclosed, increasing the likelihood of active exploitation. The post-exploitation impact includes the ability to bypass security constraints, leading to unauthorized read or write operations on the underlying data processed by the Chapter Controller. As the application follows a rolling release model, there are no specific version numbers to track, rendering all installations utilizing the aforementioned commit ID vulnerable until the underlying code is modified to enforce strict authorization controls.\nThe lack of a documented response from the vendor suggests that the vulnerability remains unpatched in the current codebase, requiring immediate manual intervention by administrators to secure affected instances."
}