# CVE-2026-85378: light0011 cms authorization bypass in Chapter Controller

Source: https://junglewise.ai/threats/cve-2026-85378-light0011-cms-authorization-bypass-in-chapter-controller  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85378 · Severity: high · CVSS 7.3 · Published 2026-09-03

light0011 is a content management system used for news publishing and article management. A critical flaw allows unauthenticated users to directly access and modify protected administrative functions, including creating, editing, deleting, and uploading content without needing to log in. An attacker can deface the site, remove articles, manipulate advertisements, and exploit file upload capabilities to take control of the system.

## Quick answers

**Is CVE-2026-85378 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85378 being exploited in the wild.

**How severe is CVE-2026-85378?** High severity, with a CVSS score of 7.3, published 3 September 2026.

**Which products and versions are affected?** light0011 cms rolling/continuous delivery (no stable versions published).

**Is there a fix for CVE-2026-85378?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85378 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-85378?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an authorization bypass vulnerability in the Chapter Controller component (App/Admin/Controller/ChapterController.class.php). The root cause is that ChapterController and AdController extend ThinkPHP's base Controller class instead of the application's AuthController, which means the session and role-based access control (RBAC) checks performed in AuthController::_initialize() are never invoked. An unauthenticated remote attacker can access administrative endpoints via HTTP requests without any session cookie or credentials. The vulnerability enables listing, creating, modifying, deleting content, and uploading files. No authentication or special preconditions are required; a simple HTTP request to administrative URLs returns 200 (success) instead of the expected 302 redirect to login. The project maintainers were notified early but have not yet responded with a patch.

## Affected products

- light0011 cms rolling/continuous delivery (no stable versions published)

## Timeline

- 2026-07-18: disclosed: Issue #4 opened on GitHub reporting unauthenticated access vulnerability
- 2026-09-03: advisory: CVE-2026-85378 published

## References

- [https://github.com/light0011/cms/](https://github.com/light0011/cms/)
- [https://github.com/light0011/cms/issues/4](https://github.com/light0011/cms/issues/4)