light0011 CMS CVE-2026-112025

Requires network reachability to a deployed instance of light0011/cms and the ability to invoke the user-related functionality handled by App/Home/Controller/UserController.class.php where the Captcha Validation component enforces its check. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no non-default configuration are stated as prerequisites. The principal limiting factor is not a configuration gate but exposure: the affected software is an unmaintained, rarely-deployed open-source CMS, and the identified impact is a captcha/access-control bypass of limited technical severity rather than data disclosure or code execution.

This is a low-to-moderate real-world risk despite a publicly available exploit. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a remote, low-complexity, unauthenticated attack, which sounds severe, but all three impact metrics are only Low (VC:L/VI:L/VA:L) with no scope change (SC:N/SI:N/SA:N), and the exploit maturity is only E:P (Proof-of-Concept), yielding the modest 5.5 score. The flaw is improper access control (CWE-284) in captcha validation - functionally a captcha bypass - which typically weakens an anti-automation control rather than directly exposing data or granting code execution, consistent with the Low impact ratings. KEV status is NOT present and no EPSS score was supplied, so there is no evidence of active or widespread exploitation; the signal is limited to a VulDB-published PoC. The most important mitigating fact is the target: light0011/cms is an obscure single-developer GitHub project, so even a working exploit has minimal real-world attack surface. Net: a legitimate but low-priority issue - the headline 'remote unauthenticated' metrics are offset by low technical impact, PoC-only maturity, and a near-zero deployment footprint.

A remote, unauthenticated attacker sends crafted requests to the UserController endpoint to defeat the captcha validation step, enabling automated abuse (e.g., credential stuffing, mass registration, or brute-forcing) that the captcha was meant to prevent. A proof-of-concept is publicly available via the project's GitHub issue tracker, lowering the barrier to reproduction. Because AC:L/PR:N/UI:N, no authentication, special conditions, or user interaction are required beyond network reachability of the affected CMS.