Which versions of Cockpit CMS are affected by CVE-2026-57855?

Cockpit CMS contains a critical file storage access control vulnerability (CVE-2026-57855, CVSS 8.7) that allows authenticated users to bypass authorization controls and access, modify, or delete…. A patch is available.

How to fix or mitigate CVE-2026-57855?

Within 24 hours: Identify all Cockpit CMS instances in your environment and document current versions; assess whether any instances handle sensitive or regulated data that could be impacted by unauthorized file access. Within 7 days: Apply the vendor-released patch for CVE-2026-57855 to non-production Cockpit CMS instances and conduct testing to ensure compatibility with existing configurations. Within 30 days: Complete patching of all production Cockpit CMS instances; implement or review access logging for bucket operations to audit for potential unauthorized access during the vulnerability window.

Cockpit CMS CVE-2026-57855

Q: What is the CVSS score of CVE-2026-57855?

CVE-2026-57855 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

HIGH

Improper Access Control (CWE-284)

2026-07-13 VulnCheck

PHP Authentication Bypass Cockpit Cms Cockpit Hq

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable API with no authorization check, exploitable by any authenticated low-privilege user (PR:L) without interaction; full read/write/delete over bucket files gives high C/I/A, scope unchanged.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 13, 2026 - 23:15 vuln.today

Analysis Generated

Jul 13, 2026 - 23:15 vuln.today

CVE Published

Jul 13, 2026 - 22:33 cve.org

HIGH 8.7

DescriptionCVE.org

Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php executes bucket commands (ls, upload, removefiles, rename, createfolder) without performing any ACL or role check. Any authenticated user, regardless of role, can perform all bucket operations on any named bucket, including buckets intended for admin use only.

AnalysisAI

Broken access control in Cockpit CMS's Bucket file storage API (/system/buckets/api) lets any authenticated user, regardless of assigned role, execute all bucket file operations (list, upload, delete, rename, create folder) against any named bucket - including admin-only buckets. VulnCheck reported the flaw and publicly available exploit code exists (proof-of-concept gist), but there is no evidence of active exploitation. With a CVSS 4.0 score of 8.7 and full confidentiality/integrity/availability impact on stored files, it enables privilege escalation of file-storage capabilities across tenant boundaries within the CMS.

Technical ContextAI

Cockpit CMS is a PHP-based, API-driven headless content management system. The vulnerability lives in the api() method of modules/System/Controller/Buckets.php, which dispatches bucket commands (ls, upload, removefiles, rename, createfolder) but never invokes any ACL, role, or permission check before executing them. 'Buckets' are named file-storage containers used to organize assets, some of which are intended to be restricted to administrators. Rooted in CWE-284 (Improper Access Control), the defect is a missing-authorization gap: authentication is enforced (a valid session/user is required) but authorization is entirely absent, so the code treats every logged-in principal as equally privileged for file operations. The affected product per CPE is cpe:2.3:a:cockpit_hq:cockpit_cms:*, fixed in the 2.14.0 release.

RemediationAI

Vendor-released patch: upgrade to Cockpit CMS 2.14.0, which adds the missing authorization enforcement to the Bucket file storage API; apply it per the fix commit dde2d1d74f5f4e11de42a298918ea8c9684f932c and the VulnCheck advisory at https://www.vulncheck.com/advisories/cockpit-cms-missing-authorization-in-bucket-file-storage-api. If you cannot upgrade immediately, restrict who holds authenticated accounts by disabling self-registration and pruning low-trust users, and place the /system/buckets/api endpoint behind a reverse-proxy or WAF rule that limits access to trusted administrator IP ranges - noting this breaks legitimate low-privilege bucket use and does not stop an authenticated insider. As a stronger stopgap, back-port the commit's authorization check into modules/System/Controller/Buckets.php so the api() method validates role/ACL before executing bucket commands. Also review bucket contents and audit logs for unauthorized uploads, deletions, or renames that may have already occurred.