Vulnerability-Lookup

GHSA-R5PM-VRC5-3M73

Vulnerability from github – Published: 2026-08-27 17:03 – Updated: 2026-08-27 17:03

Summary

cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions

Details

Impact

For jobs with shouldBeUnique = true the queue plugin will generate a 'unique identifier' based on the job class, method and parameters. If user data is supplied, a malicious user could create collisions, resulting in legitimate jobs being dropped.

Patches

Upgrade to 2.3.1

Workarounds

You can disable shouldBeUnique and handle idempotency in application code.

Severity

3.7 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "cakephp/queue"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.1.10"
            },
            {
              "fixed": "2.3.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54713"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1023"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-27T17:03:56Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "### Impact\n\nFor jobs with `shouldBeUnique = true` the queue plugin will generate a \u0027unique identifier\u0027 based on the job class, method and parameters. If user data is supplied, a malicious user could create collisions, resulting in legitimate jobs being dropped.\n\n### Patches\nUpgrade to 2.3.1\n\n### Workarounds\n\nYou can disable `shouldBeUnique` and handle idempotency in application code.",
  "id": "GHSA-r5pm-vrc5-3m73",
  "modified": "2026-08-27T17:03:57Z",
  "published": "2026-08-27T17:03:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cakephp/queue/security/advisories/GHSA-r5pm-vrc5-3m73"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cakephp/queue/pull/188"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cakephp/queue/commit/13890591e248acc8824becb24ba1939fa061bd34"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cakephp/queue"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cakephp/queue/releases/tag/2.3.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "cakephp/queue\u0027s Incomplete Comparison in getUniqueId vulnerable to collisions"
}

CVE-2026-54713 (GCVE-0-2026-54713)

Vulnerability from cvelistv5 – Published: 2026-08-27 17:03 – Updated: 2026-08-28 15:55

Title

CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions

Summary

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-28 15:55 UTC

CWE

CWE-1023 - Incomplete Comparison with Missing Factors

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/cakephp/queue/security/advisor…	x_refsource_CONFIRM
https://github.com/cakephp/queue/pull/188	x_refsource_MISC
https://github.com/cakephp/queue/commit/13890591e…	x_refsource_MISC
https://github.com/cakephp/queue/releases/tag/2.3.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
cakephp	queue	Affected: >= 0.1.11, < 2.3.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54713",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T15:55:07.774512Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T15:55:52.105Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "queue",
          "vendor": "cakephp",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.1.11, \u003c 2.3.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1023",
              "description": "CWE-1023: Incomplete Comparison with Missing Factors",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T17:03:31.580Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/cakephp/queue/security/advisories/GHSA-r5pm-vrc5-3m73",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/cakephp/queue/security/advisories/GHSA-r5pm-vrc5-3m73"
        },
        {
          "name": "https://github.com/cakephp/queue/pull/188",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cakephp/queue/pull/188"
        },
        {
          "name": "https://github.com/cakephp/queue/commit/13890591e248acc8824becb24ba1939fa061bd34",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cakephp/queue/commit/13890591e248acc8824becb24ba1939fa061bd34"
        },
        {
          "name": "https://github.com/cakephp/queue/releases/tag/2.3.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cakephp/queue/releases/tag/2.3.1"
        }
      ],
      "source": {
        "advisory": "GHSA-r5pm-vrc5-3m73",
        "discovery": "UNKNOWN"
      },
      "title": "CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54713",
    "datePublished": "2026-08-27T17:03:31.580Z",
    "dateReserved": "2026-06-15T22:58:06.563Z",
    "dateUpdated": "2026-08-28T15:55:52.105Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted