Beveiligingsadvies

CVE-2025-70866

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2026-02-13 00:00:00

Laatst bijgewerkt 2026-02-17 15:14:47

Toegewezen door mitre

CVSS-score 8.8

Status PUBLISHED

Beschrijving

LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticated user with low-level privileges (User role) can directly access the admin backend by logging in through /admin/login. The vulnerability exists because the admin and user authentication guards share the same user provider without role-based access control verification.

← Alle CVE's bekijken Bekijk op cve.org ↗