PT-2026-34005 · October · October

Published 2026-04-21 · Updated 2026-04-28 · CVE-2026-29179

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions October versions prior to 3.7.16 October versions prior to 4.1.16

Description Fine-grained sub-permission checks for asset and blueprint file operations were not enforced in the CMS and Tailor editor extensions. This allows backend users who have editor access but have editor.cms assets or editor.tailor blueprints specifically withheld to perform file operations such as create, delete, rename, move, and upload on theme assets or blueprint files. Additionally, an operator precedence error in the Tailor navigation discloses the theme blueprint directory tree under these same conditions.

Recommendations Update to version 3.7.16. Update to version 4.1.16.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-29179

GHSA-JVWG-PHXX-J3RP

Affected Products

October

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-29179 · Security Note
• https://osv.dev/vulnerability/GHSA-jvwg-phxx-j3rp · Vendor Advisory
• https://github.com/octobercms/october/security/advisories/GHSA-jvwg-phxx-j3rp · Note
• https://github.com/octobercms/october · Note
• https://twitter.com/_cvereports/status/2049063819624829253 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1ssjoms/resumen_diario_de_vulnerabilidades_22042026 · Reddit Post
• https://twitter.com/infoflowcloud/status/2046637547476951223 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1ssnpas/resumen_diario_de_vulnerabilidades_22042026 · Reddit Post
• https://twitter.com/CVEnew/status/2046636247334924480 · Twitter Post