EUVD-2026-72399
GHSA-h595-wq86-pmx6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted CSRF page with forged CMS form
-
DeliveryPhish authenticated CMS user into visiting page
-
ExploitBrowser auto-submits request with victim session cookie
-
ExecutionCMS processes forged request as authenticated user
-
ImpactUnauthorized state change executed
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must have an active authenticated session in light0011 cms at the time they are induced to visit the attacker-controlled page - unauthenticated users carry no exploitable session context. The attacker must successfully deliver a phishing link or embed malicious content that the victim's browser fetches while the CMS session is live (passive user interaction, UI:P). The CMS must be network-accessible from the victim's browser. No special server-side configuration is required beyond a running instance. Impact is strictly limited to low integrity (VI:L per CVSS 4.0); confidentiality and availability are not affected. Exploitation is limited by the narrow user base of this obscure project. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P, score 5.3) is internally consistent: network-reachable, low complexity, no attacker privileges, but passive user interaction required and impact limited to low integrity. The E:P supplemental metric confirms a public proof-of-concept exists, which marginally elevates prioritization above a theoretical finding. Real-world risk is significantly dampened by the product's negligible enterprise footprint - light0011 cms is an obscure hobby or personal project. No active exploitation has been identified (not in CISA KEV), and EPSS data is not provided. The absence of a maintainer response and the rolling-release model with no patch path are the primary escalating risk factors for any operator currently running this software. |
| Exploit ScenarioDerived | An attacker crafts an HTML page containing a hidden form targeting a state-changing CMS endpoint - for example, a content-creation or user-management action. The attacker delivers a link to this page via phishing to an authenticated CMS administrator; when the administrator visits it, the browser automatically submits the forged request with the administrator's session cookie, and the CMS executes the action as if the administrator initiated it. A public proof-of-concept demonstrating this technique is available in GitHub issue #12. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 07, 2026
Cross-site request forgery in light0011 cms (rolling-release, at minimum through commits c774dce3 and f72cf46f) allows a remote attacker to perform unauthorized state-changing operations on behalf of an authenticated CMS user by inducing that user to visit a malicious page. A public proof-of-concept is documented in GitHub issue #12, and the project maintainer has not responded to the disclosure, leaving the vulnerability unpatched. The CVSS 4.0 score of 5.3 reflects the moderate but real-world risk: low integrity impact, no confidentiality exposure, and a mandatory passive user-interaction requirement.
RemediationAI
No vendor-released patch is available at time of analysis; the project maintainer has not responded to the GitHub issue disclosure at https://github.com/light0011/cms/issues/12. As a compensating control, restrict CMS administrative access to trusted internal networks or VPN to prevent unauthenticated external network reach, which reduces the CSRF attack surface by limiting which users can be targeted. At the web server layer (Apache/nginx), configuring SameSite=Strict on session cookies will block cross-origin forged requests in modern browsers - note that this may break legitimate cross-site functionality if any exists. Administrators should also ensure users are educated to close CMS sessions before browsing untrusted sites. Monitor the upstream repository for any commits that introduce CSRF token validation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
light0011 cms is a small, rolling-release content management system available at github.com/light0011/cms (CPE: cpe:2.3:a:light0011:cms:*:*:*:*:*:*:*:*). CWE-352 (Cross-Site Request Forgery) describes the failure to verify that state-changing HTTP requests originate from the application's own authenticated context rather than from a third-party site. Without anti-CSRF tokens or equivalent mitigations on state-modifying endpoints, a victim's browser will automatically attach session cookies to forged requests, granting the attacker the victim's authorization context. The rolling-release model means no discrete version tags exist; all deployed revisions are potentially affected.
Know when Cms gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
CSRF requires victim user interaction (UI:R) and yields only low integrity impact on the vulnerable system with no confidentiality or availability loss.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. Rated c
Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (iccl
phpKF CMS 3.00 Beta allows unauthenticated PHP file upload by disguising it as a PNG, then renaming it for execution. Po
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 an
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to ex
Unauthenticated file disclosure in LavaLite CMS through 10.1.2 allows remote attackers to download private stored files
Authenticated remote code execution in Craft CMS versions 5.5.0 through 5.9.13 allows admin users to execute arbitrary P
SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitr
Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to e
Cross-site request forgery (CSRF) vulnerability in Ilch CMS allows remote attackers to hijack the authentication of admi
Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbit
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
Exploit-DB