Skip to content
OpenAdvisories

Product · lavalite

cms

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.5
    CVE-2026-108951

    LavaLite CMS through 10.1.2 Authorization Bypass via User Update API

    LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow() check. Attackers can send a PATCH request to the user update …

    lavalite cms