CVE-2021-41126

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

October is a Content Management System (CMS) and web platform built on the the Laravel PHP Framework. In affected versions administrator accounts which had previously been deleted may still be able to sign in to the backend using October CMS v2.0. The issue has been patched in v2.1.12 of the october/october package. There are no workarounds for this issue and all users should update.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
octobercms	october	>= 2.0.0, < 2.1.12

References

https://github.com/octobercms/october/security/advisories/GHSA-6gjf-7w99-j7x7Third Party Advisory
https://octobercms.com/changelogRelease Notes, Vendor Advisory
https://github.com/octobercms/october/security/advisories/GHSA-6gjf-7w99-j7x7Third Party Advisory
https://octobercms.com/changelogRelease Notes, Vendor Advisory

Timeline

Published: Oct 6, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-411277.1Rasa is an open source machine learning framework to automate text-and voice-based conversations. In affected versions a vulnerability exist CVE-2021-411288.8Hygeia is an application for collecting and processing personal and case data in connection with communicable diseases. In affected versions CVE-2021-411298.1Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user can modify the contents of a `c CVE-2021-411305.4Extensible Service Proxy, a.k.a. ESP is a proxy which enables API management capabilities for JSON/REST or gRPC API services. ESPv1 can be c CVE-2021-411318.7python-tuf is a Python reference implementation of The Update Framework (TUF). In both clients (`tuf/client` and `tuf/ngclient`), there is a CVE-2021-411326.1OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do not perform proper s CVE-2021-411337.8Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0,CVE-2021-411345.4nbdime provides tools for diffing and merging of Jupyter Notebooks. In affected versions a stored cross-site scripting (XSS) issue exists wi CVE-2021-411356.5The Cosmos-SDK is a framework for building blockchain applications in Golang. Affected versions of the SDK were vulnerable to a consensus ha CVE-2021-411363.7Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP heade CVE-2021-411378.8Minio is a Kubernetes native application for cloud storage. All users on release `RELEASE.2021-10-10T16-53-30Z` are affected by a vulnerabil CVE-2021-411385.3Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for `pallet-ethereum`, a la