CVE-2026-112026 Details
Description
A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected is the function sha1 of the file App/Home/Model/UserModel.class.php. The manipulation of the argument Password leads to password hash with insufficient computational effort. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability exists in Light0011 CMS in the file App/Home/Model/UserModel.class.php, specifically within the sha1 function. The issue arises because passwords are hashed using SHA-1 without any salt, allowing for easier cracking of password hashes. This vulnerability can be exploited remotely, but it requires a high level of complexity. The problem has been publicly disclosed, and the project maintainers have been notified but have not yet responded.
Passwords should be hashed using the password_hash() function with Argon2id or bcrypt, along with a unique salt for each password. After migrating to the new hashing method, passwords can be rehashed upon successful login and the SHA-1 comparisons retired.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/light0011/cms/ | [email protected] | ProductVendor |
| https://github.com/light0011/cms/issues/14 | [email protected] | ExploitIssue TrackingRemedyTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-112026 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1008071 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/421674 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/421674/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-326 | Inadequate Encryption Strength | [email protected] |
| CWE-916 | Use of Password Hash With Insufficient Computational Effort | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| light0011 cms | f72cf46f601efb2a0618c3814cc2f61380b38930 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 22, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |