CakePHP Queue CVE-2026-54713

Three specific conditions must all be met for exploitation: (1) the targeted job class must be configured with shouldBeUnique = true; (2) user-controlled input must be passed as job parameters at the dispatch call site - i.e., the application must forward attacker-influenced data into QueueManager::push(); and (3) the attacker must know or be able to enumerate the target job class name, method, and parameter key names to construct a colliding hash. Exploitation is not possible against jobs with fixed or application-internal-only parameters, against applications that sanitize or exclude user input from shouldBeUnique job parameters, or against job classes where shouldBeUnique is not enabled. The AC:H CVSS rating directly reflects these prerequisites.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L scoring 3.7 is assessed as accurate. AC:H is appropriate because successful exploitation requires the attacker to understand the target application's job class, method name, and parameter schema well enough to craft a colliding hash - this is application-specific knowledge, not a generic network attack. Impact is strictly Availability at Low severity: legitimate jobs are silently dropped, with no data exfiltration or code execution possible. No EPSS score was provided in the source data, so exploitation probability cannot be quantified from that signal. The vulnerability is not in CISA KEV and no public exploit code exists. The 'Information Disclosure' tag in the source intelligence appears to be a misclassification; the actual impact is job availability, not data exposure. Real-world risk is meaningful only for applications where users can influence parameters passed to shouldBeUnique jobs (e.g., public APIs that dispatch queue jobs on behalf of users).

An attacker submitting data through a public application endpoint (e.g., a form that triggers a queued notification job) crafts parameter values with a different key ordering than expected, generating the same getUniqueId hash as a legitimate pending job for another user. When the application dispatches the crafted job, the queue plugin treats it as a duplicate and drops the legitimate job - for example, silently cancelling a password reset email or order confirmation task for the targeted user.