PT-2026-57915 · Cockpit Hq · Cockpit Cms

Saidakbarxon Maxsudxonov · Publicado 2026-07-13 · Atualizado 2026-07-13 · CVE-2026-57855

NVD

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php executes bucket commands (ls, upload, removefiles, rename, createfolder) without performing any ACL or role check. Any authenticated user, regardless of role, can perform all bucket operations on any named bucket, including buckets intended for admin use only.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2026-57855

Produtos afetados

Cockpit Cms

Referências · 5

• https://github.com/Cockpit-HQ/Cockpit/commit/dde2d1d74f5f4e11de42a298918ea8c9684f932c · Correção
• https://github.com/cockpit-hq/cockpit · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-57855 · Nota de Segurança
• https://vulncheck.com/advisories/cockpit-cms-missing-authorization-in-bucket-file-storage-api · Nota
• https://gist.github.com/sermikr0/821c4edd3c34e98a62a50b07707785bd · Nota