# CVE-2026-86306: light0011 CMS improper authentication in cookie handling

Source: https://junglewise.ai/threats/cve-2026-86306-light0011-cms-improper-authentication-in-cookie-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-07. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86306 · Severity: high · CVSS 7.3 · Published 2026-09-07

light0011 is a news and content management system that allows users to publish articles and comments. An attacker can forge the username cookie to impersonate any existing user and post comments under their name, damaging trust in account attribution and enabling fraud or reputation attacks.

## Quick answers

**Is CVE-2026-86306 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86306 being exploited in the wild.

**How severe is CVE-2026-86306?** High severity, with a CVSS score of 7.3, published 7 September 2026.

**Which products and versions are affected?** light0011 CMS Rolling release (commit f72cf46f601efb2a0618c3814cc2f61380b38930 and earlier).

**Is there a fix for CVE-2026-86306?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-86306 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86306?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper authentication issue in the cookie handling mechanism. The application reads an unsigned, client-controlled username cookie directly from cookie('username') in UserModel.class.php and uses it as the authenticated identity without validation. An attacker can send a forged username cookie in an HTTP request to the comment submission endpoint, which only checks for an AJAX header and writes the untrusted username directly to the database. No server-side session validation or signature verification is performed, allowing remote attackers to impersonate any known user. The fix requires implementing server-side sessions with an immutable user ID and validating it against the account record on every action.

## Affected products

- light0011 CMS Rolling release (commit f72cf46f601efb2a0618c3814cc2f61380b38930 and earlier)

## Timeline

- 2026-07-18: disclosed: Issue reported on GitHub
- 2026-09-07: advisory: CVE-2026-86306 published

## References

- [https://github.com/light0011/cms/](https://github.com/light0011/cms/)
- [https://github.com/light0011/cms/issues/11](https://github.com/light0011/cms/issues/11)