CVE-2025-70866

PoC —

CVSS 3.1

8.8 high

EPSS

<1%p38

Published

Feb 13, 2026 (Feb 13, 2026)

Modified

Jun 17, 2026

Description

LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticated user with low-level privileges (User role) can directly access the admin backend by logging in through /admin/login. The vulnerability exists because the admin and user authentication guards share the same user provider without role-based access control verification.

Vendors: lavalite
Products: lavalite
Weakness: CWE-284
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.