DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-46696: CVE-2026-46696: Safe Mode Sandbox Bypass in October CMS via Session Store and Forwarded Builder Calls

#security #cve #cybersecurity

CVE-2026-46696: Safe Mode Sandbox Bypass in October CMS via Session Store and Forwarded Builder Calls

Vulnerability ID: CVE-2026-46696
CVSS Score: 3.3
Published: 2026-09-14

CVE-2026-46696 identifies a critical sandbox bypass vulnerability in the October CMS platform that affects the Twig template security policy when safe mode is enabled. An authenticated backend user with permissions to modify CMS markup templates can chain unrestricted session store method access with Eloquent database query forwarding omissions. This chain allows the attacker to execute arbitrary raw SQL queries to read system secrets and subsequently write those secrets directly to the active session payload, achieving unauthorized administrative privilege escalation.

TL;DR

An authenticated backend user with CMS markup editing privileges can bypass the October CMS Safe Mode sandbox to execute arbitrary raw SQL queries and write forged superuser credentials directly into the session store.

Technical Details

  • CWE ID: CWE-269 (Improper Privilege Management)
  • Attack Vector: Network
  • CVSS v3.1: 3.3 (Low)
  • Impact: Privilege Escalation / Remote Code Execution
  • Exploit Status: None
  • KEV Status: Not Listed

Affected Systems

  • October CMS System Module (october/system)
  • october/system: < 3.7.17 (Fixed in: 3.7.17)
  • october/system: >= 4.0.0, < 4.2.23 (Fixed in: 4.2.23)

Mitigation Strategies

  • Upgrade October CMS to safe versions v3.7.17 or v4.2.21/v4.2.23
  • Restrict CMS markup editing permissions to fully trusted administrative accounts
  • Implement application-level logging to detect unexpected database queries directed at backend system tables

Remediation Steps:

  1. Verify the current version of the october/system package via composer.lock
  2. Run 'composer update october/system' to pull the latest security patches
  3. Confirm the application has successfully transitioned to version 3.7.17 or 4.2.21/4.2.23
  4. Audit active backend users and restrict access to the CMS markup editor in user permissions
  5. Review server logs for unauthorized attempts to access or modify backend configuration templates

References

Read the full report for CVE-2026-46696 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)