Is CVE-2026-86307 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86307 being exploited in the wild.

How severe is CVE-2026-86307?

Medium severity, with a CVSS score of 4.3, published 7 September 2026.

Which products and versions are affected?

light0011 CMS commit f72cf46f601efb2a0618c3814cc2f61380b38930 and earlier; rolling release.

Is there a fix for CVE-2026-86307?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86307 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86307?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86307: light0011 CMS cross-site request forgery

CVE-2026-86307 · Severity: medium · CVSS 4.3 · Published 2026-09-07

light0011 CMS is a content management system used for news publishing and user interaction features. A cross-site request forgery (CSRF) vulnerability in administrative endpoints allows an attacker to trick logged-in administrators into performing destructive actions such as deleting users, navigation items, and polls, or changing comment and poll settings without their knowledge or consent.

Quick answers

Is CVE-2026-86307 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86307 being exploited in the wild.
How severe is CVE-2026-86307?: Medium severity, with a CVSS score of 4.3, published 7 September 2026.
Which products and versions are affected?: light0011 CMS commit f72cf46f601efb2a0618c3814cc2f61380b38930 and earlier; rolling release.
Is there a fix for CVE-2026-86307?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86307 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86307?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a cross-site request forgery (CSRF) flaw affecting multiple administrative state-changing endpoints in the application. The root cause is the lack of anti-CSRF token validation and insufficient HTTP method restrictions; several destructive actions are exposed as GET requests (e.g., Manager/delete, Nav/delete, Vote/delete, Vote/first), and POST endpoints similarly accept requests without CSRF protection. An attacker can exploit this by hosting malicious HTML on a different origin that, when loaded by an authenticated administrator, triggers state-changing requests using the victim's session cookie. The attack requires the target user to be logged in with administrative privileges but does not require additional user interaction beyond visiting a malicious page. There is no indication of an available patch; the project maintainer was notified through a GitHub issue but has not responded.

Affected products

light0011 CMS commit f72cf46f601efb2a0618c3814cc2f61380b38930 and earlier; rolling release

Timeline

2026-07-18: disclosed: GitHub issue #12 opened by ThanatosXingYu
2026-09-07: advisory: CVE-2026-86307 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.