PHP CVE-2026-31891

Cockpit CMS version 2.13.4 or earlier with API access enabled and /api/content/aggregate/{model} endpoint accessible. Attacker requires valid read-only API key (lowest privilege level). MongoLite Aggregation Optimizer processes unsanitized field names.

The CVSS 3.1 score of 7.7 (High) reflects network-based exploitation (AV:N) with low complexity (AC:L) requiring only low privileges (PR:L), specifically a read-only API key. The changed scope (S:C) indicates potential impact beyond the vulnerable component, though only confidentiality is affected (C:H, I:N, A:N). Without EPSS data or KEV listing, real-world exploitation likelihood remains theoretical, but the low barrier to entry (read-only API key) and straightforward attack vector make this a genuine priority for internet-exposed Cockpit instances. The vulnerability aligns with SSVC's 'attend' decision given its automatable nature, network accessibility, and high technical impact on data confidentiality.

An attacker obtains a read-only API key through social engineering or by finding it in exposed configuration files, then sends crafted requests to the /api/content/aggregate/{model} endpoint with malicious field names containing SQL injection payloads. This allows the attacker to bypass content filters and extract sensitive unpublished data from the SQLite database, potentially exposing draft content, user information, or other confidential data stored in the CMS. The attack requires no user interaction and can be automated to extract large amounts of data remotely.