GitHub Advisoryadvisory · Packagist

GHSA-r5pm-vrc5-3m73 cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions

LOW Published 2026-08-27 Modified 2026-08-27 Official page ↗
Aliases
CVE-2026-54713
Ecosystem
Packagist
Packages
cakephp/queue
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-1023
Reviewed
2026-08-27

Affected packages

• Packagist cakephp/queue: >= 0.1.10, < 2.3.1 → fixed in 2.3.1

Description

Impact For jobs with `shouldBeUnique = true` the queue plugin will generate a 'unique identifier' based on the job class, method and parameters. If user data is supplied, a malicious user could create collisions, resulting in legitimate jobs being dropped. Patches Upgrade to 2.3.1 Workarounds You can disable `shouldBeUnique` and handle idempotency in application code.

Related

Alias · CVE (1)

  • CVE-2026-54713 CakePHP Queue is a queue-interop compatible queueing library. vulnerability

Weakness · CWE (1)

  • CWE-1023 Incomplete Comparison with Missing Factors weakness

References