CVE-2026-112026

A flaw was found in light0011 cms. The application uses an insufficiently computationally intensive algorithm, SHA-1 (Secure Hash Algorithm 1), to hash user passwords. A remote attacker could exploit this weakness to recover plaintext passwords using brute-force methods, leading to information disclosure and compromised user credentials.

Red Hat has evaluated this vulnerability as having Low severity because exploiting weak password hashing algorithms requires pre-existing unauthorized access to the credential store or database dumps. Recovering user credentials requires significant offline computational resources, and this weakness cannot be directly leveraged over the network to compromise system integrity or availability. Additionally, this content management software is not distributed or deployed by default within supported Red Hat Enterprise Linux environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.