CVE-2026-46696: October CMS Safe Mode Sandbox Bypass Vulnerability
Summary
CVE-2026-46696: October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls. Affects october/system across 2 version ranges.
< 3.7.17
>= 4.0.0, < 4.2.23
Fixed in 3.7.17 or 4.2.23, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
October CMS is a popular open-source content management system built on the Laravel framework, designed for developers and users to create and manage websites easily. It offers a flexible and user-friendly interface, allowing for extensive customization through themes and plugins. However, a specific feature known as 'Safe Mode' is intended to provide a sandboxed environment for untrusted users. This feature, while useful in certain scenarios, has been found to have vulnerabilities that could be exploited if not properly managed.
Vulnerability Detail
A vulnerability was identified in the Twig sandbox security policy of October CMS that allows a chained bypass when 'cms.safe_mode' is enabled. The Laravel session store was exposed to Twig with unrestricted method access, enabling raw SQL methods through Eloquent's '__call' forwarding to be unblocked. This could allow a backend user with CMS markup editing access to read arbitrary database values and write to the backend authentication session key, effectively forging a backend session as another user. The vulnerability is particularly concerning for sites that enable Safe Mode, as it can lead to unauthorized access and impersonation of superuser accounts.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.7.173.7.17composer require october/system:3.7.17 -
>= 4.0.0, < 4.2.234.2.23composer require october/system:4.2.23
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not possible, restrict CMS markup editing access to fully trusted administrators only. Note that disabling 'cms.safe_mode' is not a viable workaround, as it removes the only sandbox between markup editors and the server.
Conclusion
CVE-2026-46696 is a significant vulnerability in October CMS that can lead to unauthorized access and session impersonation if 'cms.safe_mode' is enabled. It is essential for users to update to the latest patched versions to mitigate this risk and to follow best practices for user access management.
See every vulnerability recorded for october/system →
FAQ
The impact includes arbitrary read access to database tables and the ability to forge backend authentication sessions, allowing lower-privileged users to impersonate superusers.
Sites that have 'cms.safe_mode' enabled, have untrusted backend users with markup editing access, and at least one existing superuser account are affected.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check your application without needing to sign up.
Restrict CMS markup editing access to trusted administrators and ensure that 'cms.safe_mode' is not disabled, as it is crucial for maintaining a security boundary.
The CVSS score for this vulnerability is 3.3, indicating a low severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for october/system.
