ZeroDay Findings
Sign inSign up

Findings

CVE-2026-108951

LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing th…

Published Oct 12, 2026 · updated Oct 14, 2026

LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow() check. Attackers can send a PATCH request to the user update route with a target identifier to change name, email, password, status, or mobile, including for administrators.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 12, 2026 · NIST NVD

    Detected

    LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow() check. Attackers can send a PATCH request to the user update route with a target identifier to change name, email, password, status, or mobile, including for administrators.

  2. Oct 14, 2026 · NIST NVD

    Updated

    LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow() check. Attackers can send a PATCH request to the user update route with a target identifier to change name, email, password, status, or mobile, including for administrators.

Sources

  • CVE.orgVulnerability recordCVE-2026-108951

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-108951

    30-day exploitation probability 0.3%

    first.org
  • NIST NVDVulnerability recordCVE-2026-108951

    LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow() check. Attackers can send a PATCH request to the user update route with a target i

    nvd.nist.gov

References