What is the CVSS score of CVE-2025-70866?

CVE-2025-70866 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Lavalite are affected by CVE-2025-70866?

LavaLite CMS 10.1.0 contains a critical access control flaw that allows any authenticated user to bypass role-based restrictions and gain full administrative privileges.

Is there a public PoC exploit available for CVE-2025-70866?

Yes, a public proof-of-concept exploit is available for CVE-2025-70866. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-70866?

Within 24 hours: Audit all user accounts with CMS access and disable or demote any accounts not requiring admin privileges; implement IP whitelisting on /admin/login endpoint. Within 7 days: Deploy WAF rules to restrict /admin/login access by role/user group if supported; migrate to isolated environment or air-gap CMS if business-critical. Within 30 days: Contact LavaLite for patch ETA and security advisory; evaluate alternative CMS platforms; implement mandatory multi-factor authentication for all admin access.

Lavalite CVE-2025-70866

HIGH

Improper Access Control (CWE-284)

2026-02-13 cve@mitre.org

Authentication Bypass Lavalite

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

PoC Detected

Feb 19, 2026 - 19:35 vuln.today

Public exploit code

CVE Published

Feb 13, 2026 - 22:16 nvd

HIGH 8.8

DescriptionCVE.org

LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticated user with low-level privileges (User role) can directly access the admin backend by logging in through /admin/login. The vulnerability exists because the admin and user authentication guards share the same user provider without role-based access control verification.

AnalysisAI

Technical ContextAI

Classified as CWE-284 (Improper Access Control). Affects Lavalite. LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticated user with low-level privileges (User role) can directly access the admin backend by logging in through /admin/login. The vulnerability exists because the admin and user authentication guards share the same user provider without role-based access control verification.