cyfenced.com →

[ CVE-2026-108951 · Published 12 Oct 2026 ]

Vulnerability in lavalite cms

CVSS 6.5 EPSS <1%No fix listed yet

[ Description ]Official description

LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow() check. Attackers can send a PATCH request to the user update route with a target identifier to change name, email, password, status, or mobile, including for administrators.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References