CVE-2026-54713
LOW
3,7
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: low
Description
AI Translation Available
CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1.
1023
Incomplete Comparison with Missing Factors
IncompleteCommon Consequences
Security Scopes Affected:
Integrity
Access Control
Potential Impacts:
Alter Execution Logic
Bypass Protection Mechanism
Applicable Platforms
All platforms may be affected
https://github.com/cakephp/queue/commit/13890591e248acc8824becb24ba1939fa061bd34
https://github.com/cakephp/queue/pull/188
https://github.com/cakephp/queue/releases/tag/2.3.1
https://github.com/cakephp/queue/security/advisories/GHSA-r5pm-vrc5-3m73