{"id":36004,"date":"2026-10-13T00:32:48","date_gmt":"2026-10-12T16:32:48","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-108951"},"modified":"2026-10-13T00:32:48","modified_gmt":"2026-10-12T16:32:48","slug":"cve-2026-108951","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-108951","title":{"rendered":"CVE-2026-108951 [MEDIUM] &#8211; LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows aut"},"content":{"rendered":"<p>LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users&#8217; accounts by abusing the AbstractRequest isWorkflow() check. Attackers can send a PATCH request to the user update route with a target identifier to change name, email, password, status, or mobile, including for administrators.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users&#8217; accounts by abusing the AbstractRequest isWorkflow() ch<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-36004","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/36004","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=36004"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=36004"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=36004"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}