What’s Vulnerable › Vulnerabilities

CVE-2021-29487: Authentication bypass in Octobercms

• Severity: medium (CVSS 5.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-08-26 · updated 2026-06-17
• Weakness: CWE-287

Description

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can exploit this vulnerability to bypass authentication and takeover of and user account on an October CMS server. The vulnerability is exploitable by unauthenticated users via a specially crafted request. This only affects frontend users and the attacker must obtain a Laravel secret key for cookie encryption and signing in order to exploit this vulnerability. The issue has been patched in Build 472 and v1.1.5.

Affected products

• octobercms october: from 1.0.471 before 1.0.472; from 1.1.1 before 1.1.5 — fixed in 1.0.472, 1.1.5

How to fix

Upgrade to a fixed version: octobercms october 1.0.472, 1.1.5. Check the vendor advisory for mitigations.

References

• https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374
• https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9
• https://github.com/octobercms/october/security/advisories/GHSA-h76r-vgf3-j6w5
• https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374
• https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9
• https://github.com/octobercms/october/security/advisories/GHSA-h76r-vgf3-j6w5

Get alerted when CVE-2021-29487 or the next vulnerability affects your stack