Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-57855
PUBLISHED
More InfoOfficial Page
Assigner-VulnCheck
Assigner Org ID-83251b91-4cc7-4094-a5c7-464a1b83ea10
View Known Exploited Vulnerability (KEV) details
Published At-13 Jul, 2026 | 22:33
Updated At-14 Jul, 2026 | 21:34
Rejected At-
▼CVE Numbering Authority (CNA)
Cockpit CMS Missing Authorization in Bucket File Storage API

Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php executes bucket commands (ls, upload, removefiles, rename, createfolder) without performing any ACL or role check. Any authenticated user, regardless of role, can perform all bucket operations on any named bucket, including buckets intended for admin use only.

Affected Products
Vendor
Cockpit HQ
Product
Cockpit CMS
Default Status
affected
Versions
Affected
  • From 0 before 2.14.0 (git)
Problem Types
TypeCWE IDDescription
CWECWE-284Improper Access Control
Type: CWE
CWE ID: CWE-284
Description: Improper Access Control
Metrics
VersionBase scoreBase severityVector
4.08.7HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
3.18.8HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Version: 4.0
Base score: 8.7
Base severity: HIGH
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Version: 3.1
Base score: 8.8
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
finder
Saidakbarxon Maxsudxonov
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/cockpit-hq/cockpit
product
https://github.com/Cockpit-HQ/Cockpit/commit/dde2d1d74f5f4e11de42a298918ea8c9684f932c
patch
https://gist.github.com/sermikr0/821c4edd3c34e98a62a50b07707785bd
technical-description
https://www.vulncheck.com/advisories/cockpit-cms-missing-authorization-in-bucket-file-storage-api
third-party-advisory
Hyperlink: https://github.com/cockpit-hq/cockpit
Resource:
product
Hyperlink: https://github.com/Cockpit-HQ/Cockpit/commit/dde2d1d74f5f4e11de42a298918ea8c9684f932c
Resource:
patch
Hyperlink: https://gist.github.com/sermikr0/821c4edd3c34e98a62a50b07707785bd
Resource:
technical-description
Hyperlink: https://www.vulncheck.com/advisories/cockpit-cms-missing-authorization-in-bucket-file-storage-api
Resource:
third-party-advisory
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://gist.github.com/sermikr0/821c4edd3c34e98a62a50b07707785bd
exploit
Hyperlink: https://gist.github.com/sermikr0/821c4edd3c34e98a62a50b07707785bd
Resource:
exploit
Details not found