CVE-2026-112026 in cms
Summary
by MITRE • 10/19/2026
A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected is the function sha1 of the file App/Home/Model/UserModel.class.php. The manipulation of the argument Password leads to password hash with insufficient computational effort. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The identified vulnerability resides within the light0011 content management system, specifically targeting the sha1 function located in the App/Home/Model/UserModel.class.php file at commit c774dce31c6df0055568a8d5c53d964d99be199d. This flaw is categorized as a weakness related to password storage, where the system fails to apply sufficient computational effort when hashing user passwords. The core technical issue stems from the use of the SHA-1 algorithm for password hashing without adequate salting or iterative processing mechanisms that are standard in modern cryptographic practices. SHA-1 is inherently fast and designed for data integrity verification rather than secure key derivation, making it highly susceptible to brute-force attacks if not properly hardened with techniques such as bcrypt, scrypt, or Argon2 which intentionally introduce computational delays to thwart rapid guessing attempts.
From an operational perspective, this vulnerability allows remote attackers to potentially compromise user accounts by exploiting the weak hashing mechanism. Although the exploitability is described as difficult and requires a high degree of complexity for successful execution, the risk remains significant due to the widespread availability of precomputed rainbow tables and modern GPU-accelerated cracking tools that can rapidly reverse SHA-1 hashes when salt values are predictable or absent. The ability to initiate this attack remotely means that any user with an account in the affected system is potentially exposed if their password hash has been leaked through other vectors such as database dumps, log files, or side-channel attacks. The fact that the exploit has been disclosed publicly further increases the likelihood of automated scanning and exploitation by malicious actors who monitor public vulnerability databases for actionable exploits against widely used content management systems.
This issue aligns with CWE-759, which describes the use of a one-way hash without salt, and CWE-916, which pertains to password hashing with insufficient computational effort. In terms of adversary tactics, this weakness facilitates credential access under the MITRE ATT&CK technique T1110, specifically brute force attacks where attackers attempt to gain unauthorized access by systematically trying multiple passwords against a single or multiple accounts. The lack of response from the project maintainers despite early notification via issue reports exacerbates the risk, as it leaves users without official patches or guidance on how to mitigate the flaw in their deployments.
To mitigate this vulnerability, immediate remediation steps should focus on upgrading the password hashing mechanism within the UserModel.class.php file to a modern, adaptive hash function such as PHP's built-in password_hash() function with the PASSWORD_BCRYPT or PASSWORD_ARGON2ID algorithms. These functions automatically handle salting and adjust computational cost factors that can be tuned based on server capabilities, ensuring that each password hash requires significant resources to crack. Additionally, administrators should enforce strong password policies to reduce the effectiveness of brute-force attempts regardless of hashing strength. If an immediate code change is not feasible, implementing rate limiting on login endpoints and multi-factor authentication can provide a critical layer of defense against unauthorized access attempts derived from compromised credentials. Regular security audits and dependency updates are essential to ensure that legacy cryptographic practices do not persist in production environments.