CVE-2026-112028 Details
Description
A flaw has been found in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is some unknown functionality of the file App/Home/Controller/VoteController.class.php of the component Vote Handler. This manipulation of the argument X-Requested-With causes business logic errors. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
A business logic vulnerability has been identified in Light0011 CMS, specifically in the Vote Handler component. The issue arises in the VoteController.class.php file, where the application improperly handles the X-Requested-With header. This flaw allows for the manipulation of voting and comment reaction mechanisms, potentially leading to skewed poll results and distorted comment popularity. The vulnerability is present in commit f72cf46f601efb2a0618c3814cc2f61380b38930.
To address this vulnerability, it is recommended to implement authentication for voting and comment reactions, ensure that each user can only vote or react once, and introduce rate limits and monitoring to prevent abuse.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/light0011/cms/ | [email protected] | ProductSource CodeVendor |
| https://github.com/light0011/cms/issues/16 | [email protected] | ExploitIssue TrackingRemedyTechnical DescriptionVendor |
| https://vuldb.com/cve/CVE-2026-112028 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1008073 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/421676 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/421676/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-840 | Business Logic Errors | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| light0011 cms | f72cf46f601efb2a0618c3814cc2f61380b38930 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |