PT-2026-8034 · Unknown · Lavalite Cms

Published 2026-02-13 · Updated 2026-02-19 · CVE-2025-70866

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LavaLite CMS version 10.1.0

Description An authenticated user with low-level privileges (User role) can access the admin backend by logging in through the /admin/login endpoint. This occurs because the admin and user authentication guards share the same user provider without role-based access control verification. The vulnerable parameter is the user's authentication credentials.

Recommendations Apply role-based access control verification to the user provider used by both admin and user authentication guards.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-70866

Affected Products

Lavalite Cms

References · 9

• 🔥 https://gist.github.com/gkjzjh146/6d541c80b0666a596581ccd85bd10058 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-70866 · Security Note
• https://osv.dev/vulnerability/CVE-2025-70866 · Vendor Advisory
• https://github.com/LavaLite/cms/releases/tag/v10.1.0 · Note
• https://twitter.com/VulmonFeeds/status/2022519938066313672 · Twitter Post
• https://t.me/cveNotify/152009 · Telegram Post
• https://twitter.com/CVEnew/status/2022437751803482325 · Twitter Post
• https://t.me/cveNotify/152504 · Telegram Post
• https://t.me/CVEtracker/44664 · Telegram Post