light0011 CMS CVE-2026-112026

Exploitation requires the attacker to first obtain the stored password hashes produced by the sha1 function in App/Home/Model/UserModel.class.php - i.e., read access to the user/credential store, typically via a separate vulnerability (SQL injection, backup/file exposure, or database compromise). The weakness itself only enables faster offline cracking of those hashes once obtained; it does not grant access on its own. Limiting factors: high attack complexity (CVSS AC:H) and 'difficult' exploitability per the advisory, impact limited to confidentiality of credentials (no integrity or availability effect), and the product is a niche, unmaintained GitHub CMS with minimal real-world deployment. The CVSS PR:N/AV:N labeling should not be read as 'remotely crackable with no prerequisites' - prior access to the hash data is a hard precondition.

This is a low-real-world-priority issue despite a moderate 6.3 CVSS. The flaw is CWE-916 (use of SHA1 for password hashing in UserModel.class.php), a weak-hashing / defense-in-depth weakness rather than a directly exploitable code path. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N) nominally describes a remote, unauthenticated, high-complexity attack with only Low confidentiality impact (VC:L) and no integrity or availability impact - consistent with the reality that cracking weak hashes exposes passwords but does nothing else. There is NO EPSS score provided, the issue is NOT on the CISA KEV list (no confirmed active exploitation), and the SSVC/automatable signals are absent; the only elevated signal is a publicly available 'exploit', which in this case is merely a GitHub issue report (issues/14), not functional weaponized exploit code. Key conflict to flag explicitly: the CVSS marks AV:N/PR:N (remote, unauthenticated), but CWE-916 is only exploitable AFTER an attacker already possesses the stored password hashes (e.g., via a separate database compromise or SQLi) - so the 'network/unauthenticated' framing overstates reachability; verify the actual data flow with the project. Overall: high-CVSS-by-metric, low genuine risk given an obscure product, high attack complexity, difficult exploitability, and only a theoretical disclosure impact.

An attacker who has already obtained the application's user table (for example through a separate injection flaw or backup exposure) extracts the SHA1 password hashes stored by UserModel.class.php. Because SHA1 is a fast, unsalted/low-effort hash, the attacker runs offline brute-force or rainbow-table cracking to recover plaintext passwords. A public disclosure (GitHub issue #14) exists describing the weakness, but no weaponized exploit tool is provided, and the CVSS itself rates attack complexity as high.