Executive brief
light0011 is an open-source news content management system built on ThinkPHP that allows users to create, read, and comment on articles with tiered access levels (Normal, Intermediate, Advanced, VIP). A flaw in the Chapter Controller fails to enforce content access restrictions, allowing unauthenticated users to read restricted or paid articles by directly accessing the public endpoint with article IDs. This undermines content monetization and exposes restricted information to unauthorized readers.
Technical details
This is an authorization bypass vulnerability in the Chapter Controller's oneChapter endpoint. The root cause is that App/Home/Model/ChapterModel.class.php retrieves article records and returns content without validating the user's authentication status, membership tier, or the article's limit field (which stores the content tier: 1=Normal, 2=Intermediate, 3=Advanced, 4=VIP). The vulnerable component (Home/ChapterController.class.php:13-33) is publicly reachable and does not implement server-side entitlement checks. An attacker can craft HTTP requests to enumerate article IDs and retrieve full body content of articles marked with any tier value without authentication. The project uses rolling releases without version tracking, and the maintainer has not responded to the disclosed issue.
Affected products
- light0011 CMS rolling release (commit f72cf46f601efb2a0618c3814cc2f61380b38930 and others)
Timeline
- 2026-07-18: disclosed: Issue reported on GitHub
- 2026-09-04: advisory: CVE-2026-85381 published on NVD