CVE-2026-26274: October CMS Safe Mode Bypass Vulnerability
Summary
CVE-2026-26274: October CMS has Safe Mode Bypass via Twig Database Write Operations. Affects october/october across 2 version ranges.
< 3.7.14
>= 4.0.0, < 4.1.10
Fixed in 3.7.14 or 4.1.10, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
October CMS is a popular open-source content management system built on the Laravel framework. It provides a flexible platform for developers to create and manage websites with ease. The system features a modular architecture, allowing for extensive customization through plugins and themes. However, a vulnerability has been identified in its Twig sandbox security policy, which can lead to unauthorized database write operations when certain configurations are enabled.
Vulnerability Detail
A vulnerability exists in the Twig sandbox security policy of October CMS that permits database write operations even when 'cms.safe_mode' is enabled. This flaw allows backend users with Developer permissions to execute insert, update, and delete operations on any database table using Twig template markup. The implications of this vulnerability are severe, as it can lead to arbitrary database modifications, including the deletion of critical data. This issue is particularly concerning as it requires authenticated backend access, making it a targeted risk for systems with inadequate access controls.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.7.143.7.14composer require october/october:3.7.14 -
>= 4.0.0, < 4.1.104.1.10composer require october/october:4.1.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, restrict Developer tool access to fully trusted administrators only to mitigate the risk of exploitation.
Conclusion
The CVE-2026-26274 vulnerability in October CMS poses a significant risk due to its ability to allow unauthorized database write operations. Users are strongly encouraged to upgrade to the latest patched versions to mitigate this risk. Additionally, implementing access restrictions can serve as a temporary workaround until the upgrade is completed.
See every vulnerability recorded for october/october →
FAQ
The vulnerability allows unauthorized database write operations through the Twig template engine when 'cms.safe_mode' is enabled.
Any October CMS installation with 'cms.safe_mode' enabled and users with Developer permissions is at risk.
The vulnerability can lead to arbitrary database modifications, including data deletion and unauthorized changes to any database table.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 6.6, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for october/october.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
