LavaLite CMS Vulnerability Allows Unauthorized Access to Admin Backend

CVE-2025-70866

What is CVE-2025-70866?

LavaLite CMS version 10.1.0 is exposed to a significant vulnerability that allows authenticated users with limited privileges to gain direct access to the admin backend. This occurs through a flaw in the authentication process where both admin and user guards utilize the same user provider without implementing adequate role-based access control checks. As a result, users with lower-level roles can exploit this to access sensitive admin functionalities, posing a serious security risk to the CMS.

References