What is the CVSS score of CVE-2026-26067?

CVE-2026-26067 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-26067?

Yes, a patch is available for CVE-2026-26067. Update the affected software to the latest version immediately.

October CMS CVE-2026-26067

EUVD-2026-24153 MEDIUM

Incorrect Authorization (CWE-863)

2026-04-21 GitHub_M

GHSA-3888-q23f-x7qh

Authentication Bypass Information Disclosure October

4.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 22, 2026 - 21:08 nvd

Patch available

Apr 21, 2026 - 18:01 EUVD

Analysis Generated

Apr 21, 2026 - 17:00 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 16:30 euvd

EUVD-2026-24153

Analysis Generated

Apr 21, 2026 - 16:30 vuln.today

CVE Published

Apr 21, 2026 - 16:16 nvd

MEDIUM 4.9

DescriptionGitHub Advisory

October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a server-side information disclosure vulnerability was identified in the handling of CSS preprocessor files. Backend users with Editor permissions could craft .less, .sass, or .scss files that leverage the compiler's import functionality to read arbitrary files from the server. This worked even with cms.safe_mode enabled. This vulnerability is fixed in 3.7.14 and 4.1.10.

AnalysisAI

October CMS versions prior to 3.7.14 and 4.1.10 allow authenticated backend users with Editor permissions to read arbitrary server files by crafting malicious CSS preprocessor files (.less, .sass, .scss) that exploit the compiler's import functionality. The vulnerability persists even when cms.safe_mode is enabled, enabling high-confidence information disclosure of sensitive configuration files, credentials, and application source code without requiring administrative privileges.

Technical ContextAI

October CMS processes CSS preprocessor files (LESS, SASS, SCSS) through server-side compilers that support import directives. The vulnerability exists in the preprocessor compiler integration layer, which fails to adequately sandbox or restrict file system access when resolving import statements. The CWE-863 classification indicates improper authorization - specifically, the system fails to enforce proper access controls on file operations initiated through preprocessor compilation, allowing the compiler's native import mechanism (which typically has broad file system access) to be weaponized by lower-privileged users. This occurs at the intersection of user-supplied preprocessor syntax and privileged compiler execution, where the cms.safe_mode mitigation does not extend to preprocessor file handling.

RemediationAI

Upgrade October CMS to version 3.7.14 (for 3.x users) or 4.1.10 (for 4.x users) or later immediately. These versions include patched CSS preprocessor file handling that enforces proper file system access controls. If immediate patching is not feasible, implement compensating controls: (1) Restrict Editor role assignments to trusted personnel only - audit and remove unnecessary Editor permissions from user accounts; (2) Disable CSS preprocessor compilation features if not required for your workflow, reducing the attack surface; (3) Implement file system access controls at the OS level to prevent the web server process from reading sensitive files outside the application directory (e.g., /etc/passwd, database credential files) - this does not eliminate the vulnerability but limits data exposure; (4) Monitor and audit all .less, .sass, and .scss file uploads and compilations through backend logs. Note that cms.safe_mode does not mitigate this vulnerability - do not rely on it as a control. Upgrade is the only fully effective remedy. Detailed patching instructions are provided in the GitHub advisory.