Is CVE-2026-108951 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-108951?

CVE-2026-108951 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-108951

Description

LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow() check. Attackers can send a PATCH request to the user update route with a target identifier to change name, email, password, status, or mobile, including for administrators.