LavaLite CMS CVE-2026-108951

Requires a valid, authenticated LavaLite CMS account with low privileges (PR:L) - the attacker must be able to log in before exploiting. The specific trigger is a PATCH request to the user update API route carrying a target user identifier other than the attacker's own; the flaw lies in the AbstractRequest isWorkflow() authorization check (src/Litepie/Http/Request/AbstractRequest.php) and the user.php workflow config failing to restrict which records a caller may modify. No user interaction from the victim is needed and the default configuration appears affected. The primary limiting factor is the authentication requirement - fully unauthenticated attackers cannot exploit this - which, combined with the product's niche deployment, narrows realistic exposure to environments that permit low-trust user registration or where an attacker has already obtained low-level credentials.

This is a genuine but moderate-priority issue rather than an overhyped high-CVSS finding. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N) and the description align well: network-reachable, low attack complexity, but requiring an existing low-privileged authenticated account (PR:L) and delivering an integrity-only impact (the ability to overwrite other users' name, email, password, status, or mobile). The base score of 7.1 is driven almost entirely by VI:H, since changing an administrator's password or email is effectively an account-takeover primitive. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so exploitation probability signals are absent - this appears to be a vendor/researcher-reported flaw (VulnCheck) with no evidence of in-the-wild use. The one notable nuance: the official vector rates confidentiality and availability as N, but in practice resetting an admin's credentials can cascade into full control of the CMS, so real-world impact may exceed the integrity-only scoring - verify against the fix in LavaLite cms issue #431. Overall: real and worth patching because the privilege barrier is low and the integrity impact is severe, but the requirement for a valid authenticated account and the niche deployment footprint keep it below the tier of an unauthenticated internet-wide threat.

An attacker registers or already holds a low-privileged LavaLite CMS account, then sends a crafted PATCH request to the user update API route supplying another user's identifier - for example an administrator's. Because the AbstractRequest isWorkflow() check fails to enforce ownership/authorization, the server applies the changes, letting the attacker rewrite the admin's email and password and seize the account. No public exploit code is identified at the time of analysis, but the technique is trivial to reproduce from the referenced source lines.