TI-2021-10200 Aliases CVE-2021-29487 GHSA-h76r-vgf3-j6w5

Authentication bypass in Octobercms

LOW 34CWE-287Published 2021-08-26 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can exploit this vulnerability to bypass authentication and takeover of and user account on an October CMS server. The vulnerability is exploitable by unauthenticated users via a specially crafted request. This only affects frontend users and the attacker must obtain a Laravel secret key for cookie encryption and signing in order to exploit this vulnerability. The issue has been patched in Build 472 and v1.1.5.

Why it matters now

EPSS 0.00895 59th percentileScored 2026-11-07

Fix Fixed october (octobercms): 1.0.472, 1.1.5october/system (Packagist): 1.0.472, 1.1.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
October CMS	october	1.0.471 to before 1.0.472; 1.1.1 to before 1.1.5	1.0.472, 1.1.5	Patch available	CNA
—	october/system (Packagist)	before 1.0.472	1.0.472	Patch available	GHSA-h76r-vgf3-j6w5
—	october/system (Packagist)	1.1.1 to before 1.1.5	1.1.5	Patch available	GHSA-h76r-vgf3-j6w5

october VendorOctober CMS Affected 1.0.471 to before 1.0.472; 1.1.1 to before 1.1.5 Fixed in 1.0.472, 1.1.5 Patch available CNA
october/system (Packagist) Vendor— Affected before 1.0.472 Fixed in 1.0.472 Patch available GHSA-h76r-vgf3-j6w5
october/system (Packagist) Vendor— Affected 1.1.1 to before 1.1.5 Fixed in 1.1.5 Patch available GHSA-h76r-vgf3-j6w5

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:octobercms:october::::::::	1.0.471 to before 1.0.472; 1.1.1 to before 1.1.5	Vulnerable	October CMS

cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:* Versions 1.0.471 to before 1.0.472; 1.1.1 to before 1.1.5 Vulnerable ·October CMS

Remediation

Fix · CNA october (octobercms) Fixed in 1.0.472, 1.1.5
Fix · GHSA-h76r-vgf3-j6w5 october/system (Packagist) Fixed in 1.0.472 Advisory →
Fix · GHSA-h76r-vgf3-j6w5 october/system (Packagist) Fixed in 1.1.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-29487
2026-10-03 Alias added: GHSA-h76r-vgf3-j6w5

References

Patch 3

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2021-29487

Other 1

https://github.com/octobercms/october

TI-2021-12316 Account Takeover in Octobercms KEVCVSS 3.1CRITICAL 9.1
TI-2021-12318 Arbitrary code execution in october/system CVSS 3.1HIGH 8.8
TI-2017-14456 October CMS build 412 is vulnerable to PHP code execution in the file upload… CVSS 3.0HIGH 7.2
TI-2023-23545 A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an… CVSS 3.1MEDIUM 5.4
TI-2023-19223 An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute… CVSS 3.1MEDIUM 5.4
TI-2024-30847 October 3.6.30 allows an authenticated admin account to upload a PDF file containing… CVSS 3.1MEDIUM 4.7

See all 56 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences