Executive brief
light0011 is a news and content management system that allows users to publish articles and comments. An attacker can forge the username cookie to impersonate any existing user and post comments under their name, damaging trust in account attribution and enabling fraud or reputation attacks.
Technical details
The vulnerability is an improper authentication issue in the cookie handling mechanism. The application reads an unsigned, client-controlled username cookie directly from cookie('username') in UserModel.class.php and uses it as the authenticated identity without validation. An attacker can send a forged username cookie in an HTTP request to the comment submission endpoint, which only checks for an AJAX header and writes the untrusted username directly to the database. No server-side session validation or signature verification is performed, allowing remote attackers to impersonate any known user. The fix requires implementing server-side sessions with an immutable user ID and validating it against the account record on every action.
Affected products
- light0011 CMS Rolling release (commit f72cf46f601efb2a0618c3814cc2f61380b38930 and earlier)
Timeline
- 2026-07-18: disclosed: Issue reported on GitHub
- 2026-09-07: advisory: CVE-2026-86306 published