https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Wed, 23 Sep 2026 18:39:58 +0000 https://vulnerability.circl.lu/sighting/e883330f-69cb-41b2-b32d-15fb8f95ae9c/export {"uuid": "e883330f-69cb-41b2-b32d-15fb8f95ae9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46696", "type": "seen", "source": "https://gist.github.com/alon710/a0fdd505cf6388a20a8132f22b04c968", "content": "# CVE-2026-46696: CVE-2026-46696: Safe Mode Sandbox Bypass in October CMS via Session Store and Forwarded Builder Calls\n\n> **CVSS Score:** 3.3\n> **Published:** 2026-09-14\n> **Full Report:** https://cvereports.com/reports/CVE-2026-46696\n\n## Summary\nCVE-2026-46696 identifies a critical sandbox bypass vulnerability in the October CMS platform that affects the Twig template security policy when safe mode is enabled. An authenticated backend user with permissions to modify CMS markup templates can chain unrestricted session store method access with Eloquent database query forwarding omissions. This chain allows the attacker to execute arbitrary raw SQL queries to read system secrets and subsequently write those secrets directly to the active session payload, achieving unauthorized administrative privilege escalation.\n\n## TL;DR\nAn authenticated backend user with CMS markup editing privileges can bypass the October CMS Safe Mode sandbox to execute arbitrary raw SQL queries and write forged superuser credentials directly into the session store.\n\n## Technical Details\n\n- **CWE ID**: CWE-269 (Improper Privilege Management)\n- **Attack Vector**: Network\n- **CVSS v3.1**: 3.3 (Low)\n- **Impact**: Privilege Escalation / Remote Code Execution\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- October CMS System Module (october/system)\n- **october/system**: < 3.7.17 (Fixed in: `3.7.17`)\n- **october/system**: >= 4.0.0, < 4.2.23 (Fixed in: `4.2.23`)\n\n## Mitigation\n\n- Upgrade October CMS to safe versions v3.7.17 or v4.2.21/v4.2.23\n- Restrict CMS markup editing permissions to fully trusted administrative accounts\n- Implement application-level logging to detect unexpected database queries directed at backend system tables\n\n**Remediation Steps:**\n1. Verify the current version of the october/system package via composer.lock\n2. Run 'composer update october/system' to pull the latest security patches\n3. Confirm the application has successfully transitioned to version 3.7.17 or 4.2.21/4.2.23\n4. Audit active backend users and restrict access to the CMS markup editor in user permissions\n5. Review server logs for unauthorized attempts to access or modify backend configuration templates\n\n## References\n\n- [GitHub Security Advisory](https://github.com/octobercms/october/security/advisories/GHSA-xv9m-fm3w-8w5x)\n- [October CMS Main Repository](https://github.com/octobercms/october)\n- [CVE-2026-46696 Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-46696)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-46696) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-15T01:32:02.851932Z"} {"uuid": "e883330f-69cb-41b2-b32d-15fb8f95ae9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46696", "type": "seen", "source": "https://gist.github.com/alon710/a0fdd505cf6388a20a8132f22b04c968", "content": "# CVE-2026-46696: CVE-2026-46696: Safe Mode Sandbox Bypass in October CMS via Session Store and Forwarded Builder Calls\n\n> **CVSS Score:** 3.3\n> **Published:** 2026-09-14\n> **Full Report:** https://cvereports.com/reports/CVE-2026-46696\n\n## Summary\nCVE-2026-46696 identifies a critical sandbox bypass vulnerability in the October CMS platform that affects the Twig template security policy when safe mode is enabled. An authenticated backend user with permissions to modify CMS markup templates can chain unrestricted session store method access with Eloquent database query forwarding omissions. This chain allows the attacker to execute arbitrary raw SQL queries to read system secrets and subsequently write those secrets directly to the active session payload, achieving unauthorized administrative privilege escalation.\n\n## TL;DR\nAn authenticated backend user with CMS markup editing privileges can bypass the October CMS Safe Mode sandbox to execute arbitrary raw SQL queries and write forged superuser credentials directly into the session store.\n\n## Technical Details\n\n- **CWE ID**: CWE-269 (Improper Privilege Management)\n- **Attack Vector**: Network\n- **CVSS v3.1**: 3.3 (Low)\n- **Impact**: Privilege Escalation / Remote Code Execution\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- October CMS System Module (october/system)\n- **october/system**: < 3.7.17 (Fixed in: `3.7.17`)\n- **october/system**: >= 4.0.0, < 4.2.23 (Fixed in: `4.2.23`)\n\n## Mitigation\n\n- Upgrade October CMS to safe versions v3.7.17 or v4.2.21/v4.2.23\n- Restrict CMS markup editing permissions to fully trusted administrative accounts\n- Implement application-level logging to detect unexpected database queries directed at backend system tables\n\n**Remediation Steps:**\n1. Verify the current version of the october/system package via composer.lock\n2. Run 'composer update october/system' to pull the latest security patches\n3. Confirm the application has successfully transitioned to version 3.7.17 or 4.2.21/4.2.23\n4. Audit active backend users and restrict access to the CMS markup editor in user permissions\n5. Review server logs for unauthorized attempts to access or modify backend configuration templates\n\n## References\n\n- [GitHub Security Advisory](https://github.com/octobercms/october/security/advisories/GHSA-xv9m-fm3w-8w5x)\n- [October CMS Main Repository](https://github.com/octobercms/october)\n- [CVE-2026-46696 Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-46696)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-46696) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-15T01:32:02.851932Z"} https://vulnerability.circl.lu/sighting/e883330f-69cb-41b2-b32d-15fb8f95ae9c/export Tue, 15 Sep 2026 01:32:02 +0000