CVE-2026-54713

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54713
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54713.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54713
Aliases
Published
2026-08-27T17:03:31Z
Modified
2026-09-11T03:31:01Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions
Details

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1023"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54713.json"
}
References

Affected packages

Git / github.com/cakephp/queue

Affected ranges

Type
GIT
Repo
https://github.com/cakephp/queue
Events
Introduced
fb2bd807e9ecf867a459a685a00e21572692b6ad
Fixed
13890591e248acc8824becb24ba1939fa061bd34
Fixed
4a9d77a4865896a8464318f36962e107a0757b22
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0.1.11"
        },
        {
            "fixed": "2.3.1"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.1.11
0.1.12
2.*
2.0.1
2.1.0
2.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54713.json"