Medium severity6.5NVD Advisory· Published Oct 12, 2026
CVE-2026-108951
CVE-2026-108951
Description
LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow() check. Attackers can send a PATCH request to the user update route with a target identifier to change name, email, password, status, or mobile, including for administrators.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3Patches
Vulnerability mechanics
References
4- github.com/LavaLite/cms/issues/431nvd
- github.com/LavaLite/framework/blob/a06cba09da27087b2013035c38c536491e4f83ad/src/Litepie/Http/Request/AbstractRequest.phpnvd
- github.com/LavaLite/framework/blob/a06cba09da27087b2013035c38c536491e4f83ad/src/Litepie/User/config/user.phpnvd
- www.vulncheck.com/advisories/lavalite-cms-through-10.1.2-authorization-bypass-via-user-update-apinvd
News mentions
0No linked articles in our index yet.