CVE-2025-70866

HIGH

LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticated user with low-level privileges (User role) can directly access the admin backend by logging in through /admin/login. ...

Affects 1 product across 1 vendor.

CVSS 3.18.8
EPSS0.5%
Percentile41th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-284: Improper Access Control

Software does not restrict or incorrectly restricts access to a resource.

Related Attack Patterns (CAPEC)
CAPEC-478 Modification of Windows Service Configuration
via CWE-284
CAPEC-479 Malicious Root Certificate
via CWE-284
CAPEC-546 Incomplete Data Deletion in a Multi-Tenant Environment
via CWE-284
CAPEC-550 Install New Service
via CWE-284
CAPEC-551 Modify Existing Service
via CWE-284
Show all 17

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control, allowing low-privileged users to access the admin backend.

BSID: BS-2026-GLOBAL-032109-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2025-70866?
LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control, allowing low-privileged users to access the admin backend.
What is the CVSS score for CVE-2025-70866?
CVE-2025-70866 has CVSS 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS: 0.5%.
Is CVE-2025-70866 actively exploited?
No confirmed active exploitation of CVE-2025-70866 as of 2026-09-25.
How do I remediate CVE-2025-70866?
Priority: IMMEDIATE.
What systems are affected by CVE-2025-70866?
CVE-2025-70866 affects Lavalite Lavalite.
Vulnerability Details
CVE IDCVE-2025-70866
BSIDBS-2026-GLOBAL-032109-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published2026-02-13
Last Modified2026-06-17
ICS Relevance15%
Weakness (CWE)
Improper Access Control
SourceNVD
Official Description

LavaLite CMS 10.1.0 is vulnerable to Incorrect Access Control. An authenticated user with low-level privileges (User role) can directly access the admin backend by logging in through /admin/login. The vulnerability exists because the admin and user authentication guards share the same user provider without role-based access control verification.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An authenticated user with low-level privileges (User role) can directly access the admin backend by logging in through /admin/login. The vulnerability arises from the shared user provider between admin and user authentication guards without proper role-based access control verification.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Lavalite Lavalite 10.1.0
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 244 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash9fe4ec9716f86e20a381e57311bb73c53acb6124209c04b4b8001b58e50feb313f7b62a1622badd339e4c033f5e4779153916fd3664e9f09c5009dad5dbe1c60
Related CVEs affecting Lavalite
CVE-2023-27238 9.8 LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning. CVE-2023-36984 7.5 LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure. CVE-2023-36983 7.5 LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure. CVE-2022-42188 7.5 In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal atta... CVE-2019-18883 6.1 XSS exists in Lavalite CMS 5.7 via the admin/profile name or designation field.
View all Lavalite CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →