Is CVE-2026-85381 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85381 being exploited in the wild.

How severe is CVE-2026-85381?

Medium severity, with a CVSS score of 5.3, published 4 September 2026.

Which products and versions are affected?

light0011 CMS rolling release (commit f72cf46f601efb2a0618c3814cc2f61380b38930 and others).

Is there a fix for CVE-2026-85381?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85381 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-85381?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85381: light0011 CMS authorization bypass in Chapter Controller

CVE-2026-85381 · Severity: medium · CVSS 5.3 · Published 2026-09-04

light0011 is an open-source news content management system built on ThinkPHP that allows users to create, read, and comment on articles with tiered access levels (Normal, Intermediate, Advanced, VIP). A flaw in the Chapter Controller fails to enforce content access restrictions, allowing unauthenticated users to read restricted or paid articles by directly accessing the public endpoint with article IDs. This undermines content monetization and exposes restricted information to unauthorized readers.

Quick answers

Is CVE-2026-85381 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85381 being exploited in the wild.
How severe is CVE-2026-85381?: Medium severity, with a CVSS score of 5.3, published 4 September 2026.
Which products and versions are affected?: light0011 CMS rolling release (commit f72cf46f601efb2a0618c3814cc2f61380b38930 and others).
Is there a fix for CVE-2026-85381?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85381 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-85381?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an authorization bypass vulnerability in the Chapter Controller's oneChapter endpoint. The root cause is that App/Home/Model/ChapterModel.class.php retrieves article records and returns content without validating the user's authentication status, membership tier, or the article's limit field (which stores the content tier: 1=Normal, 2=Intermediate, 3=Advanced, 4=VIP). The vulnerable component (Home/ChapterController.class.php:13-33) is publicly reachable and does not implement server-side entitlement checks. An attacker can craft HTTP requests to enumerate article IDs and retrieve full body content of articles marked with any tier value without authentication. The project uses rolling releases without version tracking, and the maintainer has not responded to the disclosed issue.

Affected products

light0011 CMS rolling release (commit f72cf46f601efb2a0618c3814cc2f61380b38930 and others)

Timeline

2026-07-18: disclosed: Issue reported on GitHub
2026-09-04: advisory: CVE-2026-85381 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.