TI-2026-23296 Aliases CVE-2026-29179 GHSA-jvwg-phxx-j3rp

October: Editor Sub-Permission Bypass for Asset and Blueprint File Operations

LOW 15CWE-863Published 2026-04-21 · Updated 2026-04-21

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, fine-grained sub-permission checks for asset and blueprint file operations were not enforced in the CMS and Tailor editor extensions. This only affects backend users who were explicitly granted editor access but had editor.cms_assets or editor.tailor_blueprints specifically withheld, an uncommon permission configuration. In this edge case, such users could perform file operations (create, delete, rename, move, upload) on theme assets or blueprint files despite lacking the required sub-permission. A related operator precedence error in the Tailor navigation also disclosed the theme blueprint directory tree under the same conditions. This vulnerability is fixed in 3.7.16 and 4.1.16.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00144 3rd percentileScored 2026-11-07

Fix Fixed october (octobercms): 4.1.16, 3.7.16october/system (Packagist): 4.1.16, 3.7.16

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
October CMS	october	4.0.0 to before 4.1.16; before 3.7.16	4.1.16, 3.7.16	Patch available	CNA
—	october/system (Packagist)	4.0.0 to before 4.1.16	4.1.16	Patch available	GHSA-jvwg-phxx-j3rp
—	october/system (Packagist)	before 3.7.16	3.7.16	Patch available	GHSA-jvwg-phxx-j3rp

october VendorOctober CMS Affected 4.0.0 to before 4.1.16; before 3.7.16 Fixed in 4.1.16, 3.7.16 Patch available CNA
october/system (Packagist) Vendor— Affected 4.0.0 to before 4.1.16 Fixed in 4.1.16 Patch available GHSA-jvwg-phxx-j3rp
october/system (Packagist) Vendor— Affected before 3.7.16 Fixed in 3.7.16 Patch available GHSA-jvwg-phxx-j3rp

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:octobercms:october::::::::	—	—	October CMS

cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:* Versions — — ·October CMS

Remediation

Fix · CNA october (octobercms) Fixed in 4.1.16, 3.7.16
Fix · GHSA-jvwg-phxx-j3rp october/system (Packagist) Fixed in 4.1.16 Advisory →
Fix · GHSA-jvwg-phxx-j3rp october/system (Packagist) Fixed in 3.7.16 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-29179
2026-10-03 Alias added: GHSA-jvwg-phxx-j3rp

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-29179

Other 2

TI-2021-12316 Account Takeover in Octobercms KEVCVSS 3.1CRITICAL 9.1
TI-2021-12318 Arbitrary code execution in october/system CVSS 3.1HIGH 8.8
TI-2017-14456 October CMS build 412 is vulnerable to PHP code execution in the file upload… CVSS 3.0HIGH 7.2
TI-2023-23545 A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an… CVSS 3.1MEDIUM 5.4
TI-2023-19223 An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute… CVSS 3.1MEDIUM 5.4
TI-2024-30847 October 3.6.30 allows an authenticated admin account to upload a PDF file containing… CVSS 3.1MEDIUM 4.7

See all 63 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences