Executive brief
light0011 is a content management system used for news publishing and article management. A critical flaw allows unauthenticated users to directly access and modify protected administrative functions, including creating, editing, deleting, and uploading content without needing to log in. An attacker can deface the site, remove articles, manipulate advertisements, and exploit file upload capabilities to take control of the system.
Technical details
This is an authorization bypass vulnerability in the Chapter Controller component (App/Admin/Controller/ChapterController.class.php). The root cause is that ChapterController and AdController extend ThinkPHP's base Controller class instead of the application's AuthController, which means the session and role-based access control (RBAC) checks performed in AuthController::_initialize() are never invoked. An unauthenticated remote attacker can access administrative endpoints via HTTP requests without any session cookie or credentials. The vulnerability enables listing, creating, modifying, deleting content, and uploading files. No authentication or special preconditions are required; a simple HTTP request to administrative URLs returns 200 (success) instead of the expected 302 redirect to login. The project maintainers were notified early but have not yet responded with a patch.
Affected products
- light0011 cms rolling/continuous delivery (no stable versions published)
Timeline
- 2026-07-18: disclosed: Issue #4 opened on GitHub reporting unauthenticated access vulnerability
- 2026-09-03: advisory: CVE-2026-85378 published