---
id: CVE-2026-112026
title: >-
  cms: light0011 cms: Information disclosure via weak password hashing
  (CVE-2026-112026)
summary: >-
  A flaw was found in light0011 cms. The application uses an insufficiently
  computationally intensive algorithm, SHA-1 (Secure Hash Algorithm 1), to hash
  user passwords. A remote attacker could exploit this weakness to recover
  plaintext pass…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'
cvssSource: vendor
cwe:
  - CWE-916
  - CWE-326
vendor: Red Hat
product: cms
affected:
  - cms c774dce31c6df0055568a8d5c53d964d99be199d
  - cms f72cf46f601efb2a0618c3814cc2f61380b38930
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T22:44:15+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112026.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112026.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-112026'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-112026'
  - url: 'https://vuldb.com/vuln/421674'
    label: VDB-421674 | light0011 cms UserModel.class.php sha1 weak password hash
  - url: 'https://vuldb.com/vuln/421674/cti'
    label: 'VDB-421674 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-112026'
    label: CVE-2026-112026 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1008071'
    label: >-
      Submit #1008071 | light0011 cms f72cf46f601efb2a0618c3814cc2f61380b38930
      Use of Weak Hash
  - url: 'https://github.com/light0011/cms/issues/14'
  - url: 'https://github.com/light0011/cms/'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
ingestedAt: '2026-10-18T22:52:16.637Z'
---

## Overview

A flaw was found in light0011 cms. The application uses an insufficiently computationally intensive algorithm, SHA-1 (Secure Hash Algorithm 1), to hash user passwords. A remote attacker could exploit this weakness to recover plaintext passwords using brute-force methods, leading to information disclosure and compromised user credentials.

## Vendor advisories

- **Red Hat VEX** · updated 2026-10-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-112026.json)

**cms: light0011 cms: Information disclosure via weak password hashing**. Released 2026-10-18.

Not affected:

- All currently supported Red Hat products

## Remediation

Refer to the advisory for fix availability.