CVE-2026-57855

HighCVSS 8.8/10Last modified Oct 24, 2026

Description

Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php executes bucket commands (ls, upload, removefiles, rename, createfolder) without performing any ACL or role check. Any authenticated user, regardless of role, can perform all bucket operations on any named bucket, including buckets intended for admin use only.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Jul 13, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-578568.8Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System CVE-2026-578574.3The Flow Payment plugin for WordPress (flow.cl) version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout pa CVE-2026-578588.9Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that CVE-2026-578597.5e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-CVE-2026-57868.8An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attac CVE-2026-578607.8ForgeCode (tailcallhq/forgecode), an AI pair-programming CLI, automatically loads and executes the MCP servers defined in a repository's .mc CVE-2026-578628.5Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authenticated users to bypass SSRF protections by CVE-2026-578638.8Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to writ CVE-2026-578668.8Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the ai_genera CVE-2026-578678.8MicroRealEstate allows adversaries to bypass authentication due to a lack of token state management. This would permit adversaries targeting CVE-2026-578687.1MicroRealEstate is affected by broken object-level access controls in PDF generator functionality. This issue affects MicroRealEstate: thro CVE-2026-578697.1Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers t