CVE-2026-26274

October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a vulnerability was identified in the Twig sandbox security policy that allowed database write operations when cms.safe_mode is enabled. Backend users with Developer permissions could use Twig template markup to execute insert, update, and delete operations on any database table through the query builder, which is included in the sandbox allow-list. This vulnerability is fixed in 3.7.14 and 4.1.10.

CVSS v3 6.6 MEDIUM

6.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.7 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/octobercms/october/security/advisories/GHSA-h6jm-f4hh-fw27

Configurations

No configuration.

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) October es un Sistema de Gestión de Contenidos (CMS) y plataforma web. Antes de 3.7.14 y 4.1.10, se identificó una vulnerabilidad en la política de seguridad del sandbox de Twig que permitía operaciones de escritura en la base de datos cuando cms.safe_mode está habilitado. Usuarios de backend con permisos de Desarrollador podían usar el marcado de plantillas de Twig para ejecutar operaciones de inserción, actualización y eliminación en cualquier tabla de la base de datos a través del constructor de consultas, que está incluido en la lista de permitidos del sandbox. Esta vulnerabilidad está corregida en 3.7.14 y 4.1.10.

Information

Published : 2026-04-21 17:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-26274

Mitre link : CVE-2026-26274

CVE.ORG link : CVE-2026-26274

JSON object : View

Products Affected

No product.

CWE

CWE-184

Incomplete List of Disallowed Inputs

CWE-863

Incorrect Authorization

{"id": "CVE-2026-26274", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26274", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-21T19:16:28.731190Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.7}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "octobercms", "product": "october", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.1.10"}, {"status": "affected", "version": "< 3.7.14"}]}]}], "published": "2026-04-21T17:16:30.667", "references": [{"url": "https://github.com/octobercms/october/security/advisories/GHSA-h6jm-f4hh-fw27", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-184"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a vulnerability was identified in the Twig sandbox security policy that allowed database write operations when cms.safe_mode is enabled. Backend users with Developer permissions could use Twig template markup to execute insert, update, and delete operations on any database table through the query builder, which is included in the sandbox allow-list. This vulnerability is fixed in 3.7.14 and 4.1.10."}, {"lang": "es", "value": "October es un Sistema de Gesti\u00f3n de Contenidos (CMS) y plataforma web. Antes de 3.7.14 y 4.1.10, se identific\u00f3 una vulnerabilidad en la pol\u00edtica de seguridad del sandbox de Twig que permit\u00eda operaciones de escritura en la base de datos cuando cms.safe_mode est\u00e1 habilitado. Usuarios de backend con permisos de Desarrollador pod\u00edan usar el marcado de plantillas de Twig para ejecutar operaciones de inserci\u00f3n, actualizaci\u00f3n y eliminaci\u00f3n en cualquier tabla de la base de datos a trav\u00e9s del constructor de consultas, que est\u00e1 incluido en la lista de permitidos del sandbox. Esta vulnerabilidad est\u00e1 corregida en 3.7.14 y 4.1.10."}], "lastModified": "2026-10-26T22:10:00.163", "sourceIdentifier": "security-advisories@github.com"}