CVE Alert: CVE-2026-86306 – light0011

A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affects an unknown part of the file App/ /Model/UserModel.class.php of the component Cookie Helper. Executing a manipulation of the argument Username can lead to improper authentication. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

**Risk verdict:** High practical risk: the remotely exploitable authentication weakness has public exploit material, although KEV, SSVC exploitation status and EPSS are not provided, so active exploitation cannot be confirmed.

**Why this matters:** Unauthenticated attackers may gain access as another user, potentially exposing account data, altering CMS content or disrupting site availability. The main business concern is compromise of public-facing websites and trusted content, followed by defacement, credential harvesting or use of the CMS as a foothold for further attacks.

**Most likely attack path:** An attacker sends crafted requests to the exposed CMS authentication functionality, requiring no prior account, user interaction or complex setup. Scope is unchanged, so direct impact is concentrated on the CMS instance; however, stolen administrator access could enable downstream access to connected databases, publishing workflows, integrations or hosting environments.

**Who is most exposed:** Internet-facing deployments of this CMS, particularly small teams using default administrative paths, shared hosting, weak account separation or direct exposure without a web application firewall. Sites running rolling releases require careful asset discovery because fixed release boundaries are unclear.

Review authentication logs for unusual username values, repeated failed-then-successful logins and new sessions from unfamiliar networks.

Alert on administrative actions shortly after anomalous authentication.

Inspect web requests targeting the affected user-model or cookie-helper functionality.

Check for unexpected content, administrator accounts, scheduled tasks and outbound connections.

Mitigation and prioritisation:

Treat as an urgent patch or code-remediation candidate; obtain a maintainer fix or verified corrected commit.

Until fixed, restrict administrative access through VPN or allow-lists and enforce MFA where supported.

Add targeted WAF rules and rate limiting, validating that legitimate login flows remain functional.

Rotate CMS credentials and invalidate active sessions after remediation.

Because the fix and EPSS are uncertain, record compensating controls and test changes before deployment.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.