CVE-2026-108951 LavaLite CMS through 10.1.2 Authorization Bypass via User Update API

LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing the AbstractRequest isWorkflow check. Attackers can send a PATCH request to the user update route with a target identifier to change...