What is the CVSS score of CVE-2026-22692?

CVE-2026-22692 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-22692?

Yes, a patch is available for CVE-2026-22692. Update the affected software to the latest version immediately.

October CVE-2026-22692

EUVD-2026-22357 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-04-14 GitHub_M

GHSA-m5qg-jc75-4jp6

Authentication Bypass October

4.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 15, 2026 - 02:30 nvd

Patch available

Analysis Generated

Apr 14, 2026 - 18:49 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:00 euvd

EUVD-2026-22357

Analysis Generated

Apr 14, 2026 - 17:00 vuln.today

CVE Published

Apr 14, 2026 - 16:48 nvd

MEDIUM 4.9

DescriptionGitHub Advisory

October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability in the optional Twig safe mode feature (CMS_SAFE_MODE). Certain methods on the collect() helper were not properly restricted, allowing authenticated users with template editing permissions to bypass sandbox protections. Exploitation requires authenticated backend access with CMS template editing permissions and only affects installations with CMS_SAFE_MODE enabled (disabled by default). This issue has been fixed in versions 3.7.13 and 4.1.5. To workaround this issue, users can disable CMS_SAFE_MODE if untrusted template editing is not required, and restrict CMS template editing permissions to fully trusted administrators only.

AnalysisAI

Sandbox bypass in October CMS versions prior to 3.7.13 and 4.0.0-4.1.4 allows authenticated users with template editing permissions to bypass the optional Twig safe mode (CMS_SAFE_MODE) protections via unrestricted collect() helper methods. Exploitation requires authenticated backend access with CMS template editing permissions and only affects installations with the non-default CMS_SAFE_MODE feature enabled. Fixed in versions 3.7.13 and 4.1.5.

Technical ContextAI

October CMS is a Laravel-based content management system that optionally supports Twig safe mode via the CMS_SAFE_MODE configuration flag, designed to restrict template functionality for untrusted editors. The vulnerability exists in CMS_SAFE_MODE's sandbox implementation where certain methods on the collect() helper function were not properly restricted by the sandbox enforcer (CWE-693: Improper Restriction of Rendered UI Layers or Frames). This allows authenticated users with template editing permissions to invoke unrestricted methods that escape the intended sandbox boundary. The issue only manifests when CMS_SAFE_MODE is explicitly enabled; by default, this protection is disabled.

RemediationAI

Upgrade to October CMS version 3.7.13 or later (for the 3.x branch) or to version 4.1.5 or later (for the 4.x branch). For systems that cannot be immediately patched, disable CMS_SAFE_MODE if untrusted template editing is not required, and restrict CMS template editing permissions to only fully trusted administrators. Refer to the vendor security advisory at https://github.com/octobercms/october/security/advisories/GHSA-m5qg-jc75-4jp6 for detailed guidance.