CVEvulnerability

CVE-2026-54713

3.7 LOW Published 2026-08-27 Modified 2026-09-09 Official page ↗

Status: Deferred
Published: 2026-08-27
Last modified: 2026-09-09
Assigner: [email protected]
CVSS 3.1 ([email protected]): 3.7 LOW — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses: CWE-1023

Description

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1.

Weakness · CWE (1)

CWE-1023 Incomplete Comparison with Missing Factors weakness

References

https://github.com/cakephp/queue/commit/13890591e248acc8824becb24ba1939fa061bd34 github.com
https://github.com/cakephp/queue/pull/188 github.com
https://github.com/cakephp/queue/releases/tag/2.3.1 github.com
https://github.com/cakephp/queue/security/advisories/GHSA-r5pm-vrc5-3m73 github.com

CVE-2026-54713

Description

Related

Weakness · CWE (1)

References