CVE-2021-32648

CriticalCVSS 9.1/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Aug 26, 2021
Last modified: Jun 17, 2026
Added to CISA KEV: Jan 18, 2022
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-326498.8October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.CVE-2021-326508.8October CMS is a self-hosted content management system (CMS) platform based on the Laravel PHP Framework. Prior to versions 1.0.473 and 1.1.CVE-2021-326514.3OneDev is a development operations platform. If the LDAP external authentication mechanism is enabled in OneDev versions 4.4.1 and prior, an CVE-2021-326524.3Nextcloud Mail is a mail app for the Nextcloud platform. A missing permission check in Nextcloud Mail before 1.4.3 and 1.8.2 allows another CVE-2021-326532.7Nextcloud Server is a Nextcloud package that handles data storage. Nextcloud Server versions prior to 19.0.11, 20.0.10, or 21.0.2 send user CVE-2021-326549.1Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to CVE-2021-326553.5Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.11, 20.0.10, and 21.0.2, an attacker is able to CVE-2021-326568.6Nextcloud Server is a Nextcloud package that handles data storage. A vulnerability in federated share exists in versions prior to 19.0.11, 2 CVE-2021-326574.3Nextcloud Server is a Nextcloud package that handles data storage. In versions of Nextcloud Server prior to 10.0.11, 20.0.10, and 21.0.2, a CVE-2021-326584.6Nextcloud Android is the Android client for the Nextcloud open source home cloud system. Due to a timeout issue the Android client may not p CVE-2021-326594.9Matrix-appservice-bridge is the bridging service for the Matrix communication program's application services. In versions 2.6.0 and earlier,CVE-2021-326608.1Backstage is an open platform for building developer portals, and techdocs-common contains common functionalities for Backstage's TechDocs.