{"id":"CVE-2026-112025","kind":"vulnerability","aliases":["CVE-2026-112025"],"related":[],"title":"light0011 CMS: captcha validation flaw allows improper access control remotely","description":"A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This impacts an unknown function of the file App/Home/Controller/UserController.class.php of the component Captcha Validation. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","summary":"light0011 CMS never checks the CAPTCHA on the server. The CAPTCHA is only checked in browser JavaScript, so a script can register accounts and guess passwords without solving it. The Home/User register and login endpoints are affected, and the admin login has no server-side CAPTCHA or rate limiting either. The issue is public with curl reproduction steps. The project has not responded and no fix exists.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"light0011/cms","fixed":[],"affected":"c774dce31c6df0055568a8d5c53d964d99be199d, f72cf46f601efb2a0618c3814cc2f61380b38930 (rolling release, no versions)","ecosystem":"github"}],"ecosystems":[],"tags":["brute-force","captcha-bypass","light0011-cms","package","php","self-hosted"],"not_affected_if":["not-using-light0011-cms"],"how_to_check":"- Check whether your site runs light0011/cms (a ThinkPHP-style layout with App/Home/Controller/UserController.class.php).\n- Test your own site: curl -H 'X-Requested-With: XMLHttpRequest' --data 'username=test&password=x&repassword=x' http://YOURSITE/index.php/Home/User/register. If it creates a user (returns a nonzero ID) with no CAPTCHA, you are exposed.\n- Read UserController.class.php and UserModel.class.php for a server-side verify() check. The upstream issue says there is none at commit f72cf46f601efb2a0618c3814cc2f61380b38930.","fix":"No fix or patched commit exists as of 2026-10-25; the project has not answered issue #13. Workaround: add a server-side CAPTCHA check (consumed after use) before every register and login attempt, and add per-account and per-IP throttling or lockout. Or rate-limit the register and login paths at the proxy or WAF, or consider replacing the CMS.","status":"open","published_at":"2026-10-18T22:16:30+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T03:23:28+00:00","updated_at":"2026-10-25T03:43:35+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:23:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"light0011 CMS: captcha validation flaw allows improper access control remotely","impact":"medium","summary":"A weakness in the Captcha Validation function of the light0011 CMS file App/Home/Controller/UserController.class.php lets a remote attacker bypass access controls. A public exploit exists, and the project has not responded to the early issue report.","category":"package","nicknames":[],"who_cares":["light0011-cms","php","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Remote attacker bypasses access controls on user functions","analyst_note":"Find the upstream issue report and any patch or fixed commit for light0011 CMS, and confirm which access-control actions the captcha bypass unlocks (source: https://nvd.nist.gov/vuln/detail/CVE-2026-112025).","how_to_check":"- Check whether your site runs light0011 CMS by looking for App/Home/Controller/UserController.class.php in the codebase\n- Compare the commit against c774dce31c6df0055568a8d5c53d964d99be199d or f72cf46f601efb2a0618c3814cc2f61380b38930 (unknown whether these are affected or fixed)","needs_analyst":true,"not_affected_if":["not-using-light0011-cms"],"who_is_affected":"Sites running the light0011 CMS code at the affected commits, where the user controller's captcha validation is reachable from the internet. Installations that do not run this CMS can skip it. The sources do not say whether a fixed version exists.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000627,"input_tokens":3372,"output_tokens":580,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the upstream issue report and any patch or fixed commit for light0011 CMS, and confirm which access-control actions the captcha bypass unlocks (source: https://nvd.nist.gov/vuln/detail/CVE-2026-112025).","search":"'-112025':13A,16A '-2026':12A,15A 'access':8A,130C 'account':54B 'admin':71B 'affect':68B 'allow':6A 'app/home/controller/usercontroller.class.php':117C 'attack':133C,152C 'avail':143C 'browser':47B 'brute':19B 'brute-forc':18B 'bypass':23B 'c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930':108C 'captcha':3A,22B,37B,42B,78B,121C 'captcha-bypass':21B 'check':35B,45B 'cms':2A,26B,33B,107C 'compon':120C 'control':9A,131C 'could':148C 'curl':88B 'cve':11A,14A 'earli':160C 'either':82B 'endpoint':66B 'execut':123C 'exist':99B 'exploit':139C 'file':116C 'fix':98B 'flaw':5A 'forc':20B 'function':113C 'guess':56B 'home/user':62B 'host':31B 'identifi':104C 'impact':110C 'improp':7A,129C 'inform':156C 'issu':84B,163C 'javascript':48B 'launch':136C 'lead':127C 'light0011':1A,25B,32B,106C 'light0011-cms':24B 'light0011/cms':17A 'limit':81B 'login':65B,72B 'made':142C 'manipul':125C 'never':34B 'packag':27B 'password':57B 'php':28B 'problem':159C 'project':92B,154C 'public':86B,146C 'rate':80B 'regist':53B,63B 'remot':10A,137C 'report':164C 'reproduct':89B 'respond':95B,168C 'script':51B 'self':30B 'self-host':29B 'server':40B,76B 'server-sid':75B 'side':77B 'solv':59B 'step':90B 'unknown':112C 'use':150C 'valid':4A,122C 'weak':101C 'without':58B 'yet':169C","nicknames":[],"mitigations":[],"who_affected":"Anyone running light0011/cms (a PHP CMS) at commit c774dce or f72cf46, or any later checkout, with the site reachable from the internet. The flaw lets anonymous attackers mass-create accounts, check which usernames exist and guess passwords without a CAPTCHA, including on the admin login. It does not give direct code execution or data access by itself.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T22:16:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112025","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112025","severity":null,"published_at":"2026-10-18T22:16:30+00:00","modified_at":"2026-10-19T18:17:00+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112025:780","url":null,"severity":null,"published_at":"2026-10-25T03:43:35+00:00","modified_at":"2026-10-25T03:43:35+00:00","first_seen_at":"2026-10-25T03:43:35+00:00","fetched_at":"2026-10-25T03:43:35+00:00","note":"Upstream report is github.com/light0011/cms issue #13 (open since 2026-07-18, no maintainer reply, no fix commit). Server never validates CAPTCHA on register/login; it is a brute-force/mass-signup bypass, not a privilege escalation. VulDB lists no countermeasure."}],"documents":[{"id":3304,"url":"https://github.com/light0011/cms/issues/13","title":"light0011/cms #13: CAPTCHA controls are not enforced by the server","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3305,"url":"https://vuldb.com/vuln/421673","title":"VDB-421673 light0011 cms Captcha Validation access control","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}