What is the CVSS score of EUVD-2026-24159?

EUVD-2026-24159 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-24159?

Yes, a patch is available for EUVD-2026-24159. Update the affected software to the latest version immediately.

October CMS EUVD-2026-24159

| CVE-2026-29179 LOW

Incorrect Authorization (CWE-863)

2026-04-21 GitHub_M

GHSA-jvwg-phxx-j3rp

Authentication Bypass October

3.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.3 LOW

AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 22, 2026 - 21:08 nvd

Patch available

Apr 21, 2026 - 18:01 EUVD

Analysis Generated

Apr 21, 2026 - 17:01 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 16:30 euvd

EUVD-2026-24159

Analysis Generated

Apr 21, 2026 - 16:30 vuln.today

CVE Published

Apr 21, 2026 - 16:19 nvd

LOW 3.3

DescriptionGitHub Advisory

October is a Content Management System (CMS) and web platform. Prior to 3.7.16 and 4.1.16, fine-grained sub-permission checks for asset and blueprint file operations were not enforced in the CMS and Tailor editor extensions. This only affects backend users who were explicitly granted editor access but had editor.cms_assets or editor.tailor_blueprints specifically withheld, an uncommon permission configuration. In this edge case, such users could perform file operations (create, delete, rename, move, upload) on theme assets or blueprint files despite lacking the required sub-permission. A related operator precedence error in the Tailor navigation also disclosed the theme blueprint directory tree under the same conditions. This vulnerability is fixed in 3.7.16 and 4.1.16.

AnalysisAI

October CMS versions prior to 3.7.16 and 4.1.16 fail to enforce fine-grained sub-permission checks for asset and blueprint file operations in the CMS and Tailor editor extensions, allowing backend users with editor access but explicitly withheld editor.cms_assets or editor.tailor_blueprints permissions to perform unauthorized file operations (create, delete, rename, move, upload) on theme assets and blueprint files. Additionally, an operator precedence error discloses the theme blueprint directory tree under the same conditions. This affects an uncommon permission configuration where high-privileged users have granular restrictions selectively applied.

Technical ContextAI

October CMS is a Laravel-based open-source content management system that provides role-based access control through a permission system. The vulnerability exists in permission enforcement logic within the CMS and Tailor editor extensions, which handle asset management and blueprint file operations. The root cause is classified as CWE-863 (Incorrect Authorization), indicating a failure to check permissions before allowing sensitive operations. The issue stems from an operator precedence error in permission evaluation logic, allowing authenticated backend users to bypass sub-permission checks that should restrict file operations on specific resource types (theme assets and blueprint files). Tailor is October's modern page-building extension that manages blueprint definitions stored in the filesystem.

RemediationAI

Upgrade to October CMS 3.7.16 or 4.1.16 to apply the vendor-released patch that implements proper sub-permission enforcement. For organizations unable to immediately patch, apply compensating controls by auditing and removing uncommon mixed-permission configurations where backend users are granted editor access while having specific sub-permissions (editor.cms_assets or editor.tailor_blueprints) explicitly withheld. Prefer binary permission models where users either have full editor privileges including asset/blueprint permissions or are restricted from editing entirely, avoiding the intermediate state that triggers this vulnerability. Monitor file operations on theme assets and blueprint directories for unauthorized modifications by backend users. Review audit logs for users with editor roles to identify those with atypical permission assignments. See GitHub Security Advisory GHSA-jvwg-phxx-j3rp for additional details and patch download links.