EUVD-2026-67241
GHSA-r5pm-vrc5-3m73
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-reachable via application endpoints, but AC:H due to required knowledge of job schema; impact is availability-only from job-dropping with no confidentiality or integrity consequence.
Primary rating from Vendor (https://github.com/cakephp/queue).
CVSS VectorVendor: https://github.com/cakephp/queue
Lifecycle Timeline
2DescriptionCVE.org
Impact
For jobs with shouldBeUnique = true the queue plugin will generate a 'unique identifier' based on the job class, method and parameters. If user data is supplied, a malicious user could create collisions, resulting in legitimate jobs being dropped.
Patches
Upgrade to 2.3.1
Workarounds
You can disable shouldBeUnique and handle idempotency in application code.
AnalysisAI
Job deduplication in the cakephp/queue plugin can be bypassed by attackers who control job parameter data, causing legitimate unique jobs to be silently dropped. The flaw affects all applications using shouldBeUnique = true on job classes where user-supplied input is passed as job parameters - versions 0.1.10 through 2.3.0. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three specific conditions must all be met for exploitation: (1) the targeted job class must be configured with `shouldBeUnique = true`; (2) user-controlled input must be passed as job parameters at the dispatch call site - i.e., the application must forward attacker-influenced data into `QueueManager::push()`; and (3) the attacker must know or be able to enumerate the target job class name, method, and parameter key names to construct a colliding hash. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L scoring 3.7 is assessed as accurate. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade cakephp/queue to version 2.3.1 or later by running `composer require cakephp/queue:^2.3.1`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today