CVE-2026-54713

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1.

CVSS v3 3.7 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/cakephp/queue/commit/13890591e248acc8824becb24ba1939fa061bd34
https://github.com/cakephp/queue/pull/188
https://github.com/cakephp/queue/releases/tag/2.3.1
https://github.com/cakephp/queue/security/advisories/GHSA-r5pm-vrc5-3m73

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-27 20:17

Updated : 2026-09-09 21:09

NVD link : CVE-2026-54713

Mitre link : CVE-2026-54713

CVE.ORG link : CVE-2026-54713

JSON object : View

Products Affected

No product.

CWE

CWE-1023

Incomplete Comparison with Missing Factors

{"id": "CVE-2026-54713", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54713", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-28T15:55:07.774512Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "cakephp", "product": "queue", "versions": [{"status": "affected", "version": ">= 0.1.11, < 2.3.1"}]}]}], "published": "2026-08-27T20:17:49.670", "references": [{"url": "https://github.com/cakephp/queue/commit/13890591e248acc8824becb24ba1939fa061bd34", "source": "security-advisories@github.com"}, {"url": "https://github.com/cakephp/queue/pull/188", "source": "security-advisories@github.com"}, {"url": "https://github.com/cakephp/queue/releases/tag/2.3.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/cakephp/queue/security/advisories/GHSA-r5pm-vrc5-3m73", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1023"}]}], "descriptions": [{"lang": "en", "value": "CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1."}], "lastModified": "2026-09-09T21:09:13.080", "sourceIdentifier": "security-advisories@github.com"}