CVE-2026-22692

{
  "id": "CVE-2026-22692",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-14T17:16:28.423",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections. Exploitation requires authenticated backend access with CMS template editing permissions and only affects installations with CMS_SAFE_MODE enabled (disabled by default). This issue has been fixed in versions 3.7.13 and 4.1.5. To workaround this issue, users can disable CMS_SAFE_MODE if untrusted template editing is not required, and restrict CMS template editing permissions to fully trusted administrators only."
    },
    {
      "lang": "es",
      "value": "October es un Sistema de Gestión de Contenidos (CMS) y plataforma web. Las versiones anteriores a la 3.7.13 y las versiones 4.0.0 a la 4.1.4 contienen una vulnerabilidad de bypass de sandbox en la característica opcional de modo seguro de Twig (CMS_SAFE_MODE). Ciertos métodos en el ayudante collect() no estaban correctamente restringidos, permitiendo a usuarios autenticados con permisos de edición de plantillas saltarse las protecciones de sandbox. La explotación requiere acceso autenticado al backend con permisos de edición de plantillas de CMS y solo afecta a instalaciones con CMS_SAFE_MODE habilitado (deshabilitado por defecto). Este problema ha sido solucionado en las versiones 3.7.13 y 4.1.5. Para aplicar una solución alternativa a este problema, los usuarios pueden deshabilitar CMS_SAFE_MODE si no se requiere la edición de plantillas no confiables, y restringir los permisos de edición de plantillas de CMS solo a administradores de plena confianza."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "octobercms",
          "product": "october",
          "versions": [
            {
              "version": "< 3.7.13",
              "status": "affected"
            },
            {
              "version": ">= 4.0.0, < 4.1.5",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 4.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 3.6
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 4.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-14T19:42:23.040347Z",
          "id": "CVE-2026-22692",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        },
        {
          "lang": "en",
          "value": "CWE-693"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "3.7.13",
              "matchCriteriaId": "BD599F53-B664-4667-9A0A-D745EF8D777B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.0.0",
              "versionEndExcluding": "4.1.5",
              "matchCriteriaId": "7AA00A10-35F7-4084-AEE2-2DC6E2844E88"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/octobercms/october/security/advisories/GHSA-m5qg-jc75-4jp6",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}