October CMS CVE-2026-26067

Exploitation requires the following specific, concrete conditions: (1) Valid October CMS backend account with Editor role or higher permissions - unauthenticated users cannot exploit this vulnerability; (2) Ability to upload or create .less, .sass, or .scss files through the October CMS backend interface (typically via asset manager, theme editor, or file upload mechanisms); (3) Server-side CSS preprocessor compilation must be enabled (default in October CMS); (4) The cms.safe_mode configuration setting provides no protection - this vulnerability bypasses it and exploitation succeeds regardless of safe_mode status. Limitations on exploitation: (1) requires authenticated backend access, eliminating exposure to completely remote unauthenticated attackers; (2) requires Editor role specifically (not Guest or Subscriber), limiting exposure to users with content management responsibilities; (3) the attacker can only read files accessible to the web server process user - typically application files, configuration, and shared system files, but not root-owned system files or files outside the web server's permission scope. The vulnerability does not grant code execution or modify capability; impact is limited to information disclosure.

The CVSS score of 4.9 reflects a network-accessible vulnerability with high confidentiality impact but low attack complexity and high privilege requirements (PR:H - Editor role needed). The risk profile is moderate but not critical: exploitation requires legitimate backend access (Editor permissions), eliminating exposure to completely unauthenticated remote attackers. However, the data leak severity is significant - arbitrary file read can expose database credentials, API keys, and application secrets. The vulnerability is highly reliable (AC:L, UI:N) once an attacker has Editor credentials, suggesting high exploitation probability among compromised or insider threats. No public exploit code, KEV listing, or active exploitation evidence is provided in the input data. The real-world risk depends heavily on (1) prevalence of Editor-level account compromise in deployed instances, and (2) frequency of preprocessor file uploads in typical October CMS workflows. Organizations with strict backend access controls and minimal preprocessor usage face lower risk; those with permissive Editor role grants or content team access face elevated risk despite the moderate CVSS.

An attacker with compromised or leaked Editor credentials logs into the October CMS backend. They navigate to the file manager or asset upload interface and upload a malicious .scss file containing @import statements targeting sensitive files such as .env (containing database credentials), config/database.yml, or other configuration files containing API keys. When the preprocessor compiler processes the upload, it resolves the import directives and reads the arbitrary files from the server file system. The attacker intercepts the compiler output or error messages to extract the file contents, obtaining application secrets without leaving obvious evidence beyond the uploaded preprocessor file.