CVE-2026-29179

{
  "id": "CVE-2026-29179",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-21T17:16:36.053",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, fine-grained sub-permission checks for asset and blueprint file operations were not enforced in the CMS and Tailor editor extensions. This only affects backend users who were explicitly granted editor access but had editor.cms_assets or editor.tailor_blueprints specifically withheld, an uncommon permission configuration. In this edge case, such users could perform file operations (create, delete, rename, move, upload) on theme assets or blueprint files despite lacking the required sub-permission. A related operator precedence error in the Tailor navigation also disclosed the theme blueprint directory tree under the same conditions. This vulnerability is fixed in 3.7.16 and 4.1.16."
    },
    {
      "lang": "es",
      "value": "October es un Sistema de Gestión de Contenidos (CMS) y plataforma web. Antes de las versiones 3.7.16 y 4.1.16, las comprobaciones de subpermisos granulares para las operaciones de archivos de activos y planos no se aplicaban en las extensiones de editor de CMS y Tailor. Esto solo afecta a los usuarios de backend a quienes se les concedió explícitamente acceso de editor pero se les denegó específicamente editor.cms_assets o editor.tailor_blueprints, una configuración de permisos poco común. En este caso límite, dichos usuarios podían realizar operaciones de archivos (crear, eliminar, renombrar, mover, cargar) en activos de temas o archivos de planos a pesar de carecer del subpermiso requerido. Un error de precedencia de operador relacionado en la navegación de Tailor también divulgó el árbol de directorios de planos de temas bajo las mismas condiciones. Esta vulnerabilidad está corregida en las versiones 3.7.16 y 4.1.16."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "octobercms",
          "product": "october",
          "versions": [
            {
              "version": ">= 4.0.0, < 4.1.16",
              "status": "affected"
            },
            {
              "version": "< 3.7.16",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 3.3,
          "baseSeverity": "LOW",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 0.7,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-21T16:46:35.787896Z",
          "id": "CVE-2026-29179",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/octobercms/october/security/advisories/GHSA-jvwg-phxx-j3rp",
      "source": "[email protected]"
    }
  ]
}