CVE-2026-29179

{"id": "CVE-2026-29179", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-29179", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-21T16:46:35.787896Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 0.7}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "octobercms", "product": "october", "versions": [{"status": "affected", "version": ">= 4.0.0, < 4.1.16"}, {"status": "affected", "version": "< 3.7.16"}]}]}], "published": "2026-04-21T17:16:36.053", "references": [{"url": "https://github.com/octobercms/october/security/advisories/GHSA-jvwg-phxx-j3rp", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, fine-grained sub-permission checks for asset and blueprint file operations were not enforced in the CMS and Tailor editor extensions. This only affects backend users who were explicitly granted editor access but had editor.cms_assets or editor.tailor_blueprints specifically withheld, an uncommon permission configuration. In this edge case, such users could perform file operations (create, delete, rename, move, upload) on theme assets or blueprint files despite lacking the required sub-permission. A related operator precedence error in the Tailor navigation also disclosed the theme blueprint directory tree under the same conditions. This vulnerability is fixed in 3.7.16 and 4.1.16."}, {"lang": "es", "value": "October es un Sistema de Gesti\u00f3n de Contenidos (CMS) y plataforma web. Antes de las versiones 3.7.16 y 4.1.16, las comprobaciones de subpermisos granulares para las operaciones de archivos de activos y planos no se aplicaban en las extensiones de editor de CMS y Tailor. Esto solo afecta a los usuarios de backend a quienes se les concedi\u00f3 expl\u00edcitamente acceso de editor pero se les deneg\u00f3 espec\u00edficamente editor.cms_assets o editor.tailor_blueprints, una configuraci\u00f3n de permisos poco com\u00fan. En este caso l\u00edmite, dichos usuarios pod\u00edan realizar operaciones de archivos (crear, eliminar, renombrar, mover, cargar) en activos de temas o archivos de planos a pesar de carecer del subpermiso requerido. Un error de precedencia de operador relacionado en la navegaci\u00f3n de Tailor tambi\u00e9n divulg\u00f3 el \u00e1rbol de directorios de planos de temas bajo las mismas condiciones. Esta vulnerabilidad est\u00e1 corregida en las versiones 3.7.16 y 4.1.16."}], "lastModified": "2026-10-26T21:10:00.170", "sourceIdentifier": "security-advisories@github.com"}