Authorization bypass in LavaLite CMS user update API
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
LavaLite CMS through 10.1.2 contains an authorization bypass that lets an authenticated low-privileged user modify other users' accounts, including administrators. The flaw is incorrect authorization (CWE-863) in the AbstractRequest isWorkflow() check. An attacker sends a PATCH request to the user update route with a target identifier to change the name, email, password, status, or mobile of another account. The CVSS 4.0 vector requires network access and low privileges with no user interaction and rates the impact on the vulnerable system as high integrity.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow() check. Attackers can send a PATCH request to the user update route with a target identifier to change name, email, password, status, or mobile, including for administrators.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for LavaLite CMS.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-12 Threatist record created from CVE-2026-108951
- 2026-10-12 Alias added: GHSA-pj48-vpfx-3cj9
- 2026-10-13 Priority changed: MEDIUM → LOW
- 2026-10-15 CISA SSVC decision points changed
References
Other 4
- https://github.com/LavaLite/cms/issues/431
- https://github.com/LavaLite/framework/blob/a06cba09da27087b2013035c38c536491e4f83ad/src/Litepie/Http/Request/AbstractRequest.php#L62-L70
- https://github.com/LavaLite/framework/blob/a06cba09da27087b2013035c38c536491e4f83ad/src/Litepie/User/config/user.php#L515
- https://github.com/LavaLite/cms
More lavalite vulnerabilities
- TI-2026-76807 LavaLite CMS Filer routes lack authentication, exposing files CVSS 4.0HIGH 8.7
- TI-2025-43153 LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. CVSS 3.1HIGH 8.8
- TI-2022-20443 In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks… CVSS 3.1HIGH 7.5
- TI-2025-43317 LavaLite CMS <= 10.1.0 Stored XSS via Package Creation and Search CVSS 4.0MEDIUM 5.1
- TI-2023-11992 LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning. CVSS 3.1CRITICAL 9.8
- TI-2023-18730 LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure. CVSS 3.1HIGH 7.5
Sources
- CVE-2026-108951 · CVE Program
- CVE-2026-108951 · NVD
- FIRST EPSS
- GHSA-pj48-vpfx-3cj9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences