Authorization Bypass in LavaLite CMS Affects User Accounts

CVE-2026-108951

What is CVE-2026-108951?

LavaLite CMS versions through 10.1.2 are susceptible to an authorization bypass vulnerability, allowing authenticated low-privileged users to exploit the AbstractRequest isWorkflow() check. This flaw enables attackers to execute a PATCH request to the user update route, granting them the ability to alter the details of other users' accounts, including names, emails, passwords, statuses, and mobile numbers, even for administrators. This vulnerability poses a significant risk as it can lead to unauthorized changes and potential breaches of user data.

References