---
id: "CVE-2026-112025"
kind: "vulnerability"
aliases: ["CVE-2026-112025"]
title: "light0011 CMS: captcha validation flaw allows improper access control remotely"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "light0011/cms", "fixed": [], "affected": "c774dce31c6df0055568a8d5c53d964d99be199d, f72cf46f601efb2a0618c3814cc2f61380b38930 (rolling release, no versions)", "ecosystem": "github"}]
ecosystems: []
tags: ["brute-force", "captcha-bypass", "light0011-cms", "package", "php", "self-hosted"]
not_affected_if: ["not-using-light0011-cms"]
published_at: "2026-10-18T22:16:30+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T03:43:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112025", "first_seen_at": "2026-10-23T21:57:17+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:43:35+00:00"}]
---

# light0011 CMS: captcha validation flaw allows improper access control remotely

light0011 CMS never checks the CAPTCHA on the server. The CAPTCHA is only checked in browser JavaScript, so a script can register accounts and guess passwords without solving it. The Home/User register and login endpoints are affected, and the admin login has no server-side CAPTCHA or rate limiting either. The issue is public with curl reproduction steps. The project has not responded and no fix exists.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:light0011/cms affected c774dce31c6df0055568a8d5c53d964d99be199d, f72cf46f601efb2a0618c3814cc2f61380b38930 (rolling release, no versions) fixed ?

## How to check

- Check whether your site runs light0011/cms (a ThinkPHP-style layout with App/Home/Controller/UserController.class.php).
- Test your own site: curl -H 'X-Requested-With: XMLHttpRequest' --data 'username=test&password=x&repassword=x' http://YOURSITE/index.php/Home/User/register. If it creates a user (returns a nonzero ID) with no CAPTCHA, you are exposed.
- Read UserController.class.php and UserModel.class.php for a server-side verify() check. The upstream issue says there is none at commit f72cf46f601efb2a0618c3814cc2f61380b38930.

## Fix

No fix or patched commit exists as of 2026-10-25; the project has not answered issue #13. Workaround: add a server-side CAPTCHA check (consumed after use) before every register and login attempt, and add per-account and per-IP throttling or lockout. Or rate-limit the register and login paths at the proxy or WAF, or consider replacing the CMS.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112025
- 2026-10-25T03:43:35+00:00 analyst — Upstream report is github.com/light0011/cms issue #13 (open since 2026-07-18, no maintainer reply, no fix commit). Server never validates CAPTCHA on register/login; it is a brute-force/mass-signup bypass, not a privilege escalation. VulDB lists no countermeasure.

## Documents

- [advisory] light0011/cms #13: CAPTCHA controls are not enforced by the server https://github.com/light0011/cms/issues/13
- [describes] VDB-421673 light0011 cms Captcha Validation access control https://vuldb.com/vuln/421673

## From the sources

A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This impacts an unknown function of the file App/Home/Controller/UserController.class.php of the component Captcha Validation. Executing a manipulation can lead to improper access controls. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_