Is CVE-2026-112025 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-112025 being exploited in the wild.

How severe is CVE-2026-112025?

High severity, with a CVSS score of 7.3, published 18 October 2026.

How is CVE-2026-112025 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-112025?

Check whether you run Light0011 CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-112025: light0011 CMS improper CAPTCHA validation in user registration

CVE-2026-112025 · Severity: high · CVSS 7.3 · Published 2026-10-18

light0011 CMS is a content management system that presents CAPTCHA challenges during user registration and login to prevent automated attacks. However, the application does not validate CAPTCHA on the server side, allowing attackers to bypass this protection entirely by sending requests directly to the API without solving the challenge. This enables account creation automation, username enumeration, and password guessing attacks.

Technologies: Light0011 CMS. Vendors: Light0011.

Quick answers

Is CVE-2026-112025 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-112025 being exploited in the wild.
How severe is CVE-2026-112025?: High severity, with a CVSS score of 7.3, published 18 October 2026.
Which products and versions are affected?: Light0011 CMS commit f72cf46f601efb2a0618c3814cc2f61380b38930 and prior.
Is there a fix for CVE-2026-112025?: No fixed version is recorded yet. Implement server-side CAPTCHA validation in App/Home/Controller/UserController.class.php before processing any login or registration request, consume the CAPTCHA token after single use, and add account and IP-based rate limiting with lockout controls to mitigate brute force attacks.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-18"}, {"kind": "exploited", "at": "2026-07-18", "note": "Proof-of-concept disclosed in GitHub issue"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-112025 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-112025?: Check whether you run Light0011 CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Implement server-side CAPTCHA validation in App/Home/Controller/UserController.class.php before processing any login or registration request, consume the CAPTCHA token after single use, and add account and IP-based rate limiting with lockout controls to mitigate brute force attacks.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-18"}, {"kind": "exploited", "at": "2026-07-18", "note": "Proof-of-concept disclosed in GitHub issue"}]

Technical details

The vulnerability is an improper input validation flaw in the UserController.class.php component where CAPTCHA checks are only performed client-side via JavaScript. An attacker can bypass the captcha requirement by sending direct HTTP requests (e.g., via curl) without the CAPTCHA verification parameter, and the server processes registration and login attempts normally. The issue affects all versions including commit f72cf46f601efb2a0618c3814cc2f61380b38930, and a proof-of-concept has been published showing successful account registration without CAPTCHA.

Affected products

light0011 CMS commit f72cf46f601efb2a0618c3814cc2f61380b38930 and prior

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.