SB2026091425 - Multiple vulnerabilities in October CMS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026091425

SB2026091425 - Multiple vulnerabilities in October CMS

Published: September 14, 2026

Security Bulletin ID SB2026091425
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary script in the backend origin.

The vulnerability exists due to improper neutralization of input during web page generation in the backend Event Log preview\'s client-side exception beautifier when an administrator opens a log preview containing crafted brace tokens in an exception message. A remote privileged user can supply a logged exception message containing crafted brace tokens to execute arbitrary script in the backend origin.

The crafted payload remains persistent until the affected log entry is deleted.


2) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the Twig sandbox SecurityPolicy request-object allowlist when processing Safe Mode Twig templates. A remote privileged user can invoke exposed request-object methods to disclose sensitive information.

Exploitation requires CMS markup editing access.


3) Deserialization of Untrusted Data (CVE-ID: CVE-2026-49400)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary PHP code.

The vulnerability exists due to deserialization of untrusted data in the backend SessionMaker trait when reading widget session state. A remote privileged user can write attacker-controlled data to a widget session key to execute arbitrary PHP code.

Exploitation requires cms.safe_mode to be enabled and a suitable PHP gadget chain reachable from the installed dependency set.


4) Improper privilege management (CVE-ID: CVE-2026-46696)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read arbitrary database values and impersonate an existing superuser.

The vulnerability exists due to improper access control in the Twig sandbox security policy when processing CMS markup templates with safe mode enabled. A remote privileged user can invoke raw SQL methods through forwarded builder calls and write a forged backend authentication session value to impersonate an existing superuser.

Exploitation requires CMS markup editing access and the presence of an existing superuser account.


Remediation

Install update from vendor's website.

References