CVE-2026-46696: October CMS Auth Bypass Vulnerability

CVE-2026-46696 Overview

CVE-2026-46696 affects the October Content Management System (CMS) system module. The vulnerability resides in the Twig sandbox security policy that enforces cms.safe_mode. A backend user with CMS markup editing access can chain unrestricted access to the Laravel session store with raw SQL methods reachable through Eloquent's __call forwarding. This chain allows the attacker to read arbitrary database values and write to the backend authentication session key, forging a session as a higher-privileged existing user. The issue is patched in versions 3.7.17 and 4.2.21. The scope is narrow and only impacts sites that deliberately enable Safe Mode for demos or untrusted-editor scenarios.

Critical Impact
Authenticated backend users with markup editing rights can escalate privileges to an existing superuser by forging the backend authentication session through the Twig sandbox bypass.

Affected Products

October CMS System module versions prior to 3.7.17 (3.x branch)
October CMS System module versions prior to 4.2.21 (4.x branch)
Deployments with cms.safe_mode explicitly enabled

Discovery Timeline

2026-09-14 - CVE-2026-46696 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-46696

Vulnerability Analysis

The vulnerability is a chained sandbox bypass classified as improper privilege management [CWE-269]. October CMS uses a Twig sandbox policy to restrict what markup editors can call when cms.safe_mode is enabled. Two gaps in that policy combine into a single privilege escalation path.

First, the Laravel session store was exposed to Twig with unrestricted method access. This gave sandboxed templates the ability to write directly to any session key, including the backend authentication key. Second, raw SQL and subquery methods were not consistently blocked across the Eloquent query builder chain. The blocklist covered some entry points but not calls reachable through __call forwarding on Query\Builder, Eloquent\Builder, and Eloquent\Model.

Exploitation requires an authenticated backend user with markup editing rights, plus an existing superuser account whose session can be impersonated. The attacker uses raw SQL through Twig to extract identifiers from the database, then writes the forged authentication payload into the session store to assume that superuser identity.

Root Cause

The root cause is an incomplete sandbox boundary. The Twig security policy did not enforce a strict allowlist for session store methods and did not propagate its raw-SQL blocklist across the full Eloquent __call forwarding chain. This left both a write primitive (session mutation) and a read primitive (selectRaw, whereRaw, orderByRaw, joinSub) accessible from sandboxed markup.

Attack Vector

The attack vector is network-based and requires authenticated access to the October CMS backend with CMS markup editing privileges. The attacker crafts a Twig template that first invokes raw SQL builder methods to enumerate user records, then invokes the exposed Laravel session store to overwrite the admin_auth or october_auth session key. On the next request, the backend treats the attacker as the impersonated superuser.

No verified proof-of-concept code is published. Refer to the GitHub Security Advisory GHSA-xv9m-fm3w-8w5x for the vendor's technical description.

Detection Methods for CVE-2026-46696

Indicators of Compromise

Unexpected changes to CMS markup templates that reference session, selectRaw, whereRaw, orderByRaw, or joinSub inside Twig blocks.
Backend authentication events where the session identity differs from the originating user account.
Database queries containing raw SQL fragments originating from the CMS markup renderer rather than application code paths.

Detection Strategies

Audit CMS pages, partials, and layouts for Twig calls that touch the Laravel session store or the query builder.
Review web server and application logs for backend user activity that transitions to superuser context without a corresponding login event.
Correlate markup edit events with subsequent privileged administrative actions performed under a different account.

Monitoring Recommendations

Enable audit logging for all CMS markup edits and track the authoring user identity for each revision.
Monitor session storage for writes to reserved keys (admin_auth, october_auth, login_*, _token) from application contexts other than the authentication controller.
Alert on backend logins that reuse an existing valid session but originate from a different client fingerprint or IP address.

How to Mitigate CVE-2026-46696

Immediate Actions Required

Upgrade the October CMS system module to 3.7.17 or 4.2.21 or later.
Inventory backend user accounts and remove markup editing privileges from any account not fully trusted as an administrator.
Review existing CMS templates for suspicious Twig calls that reference the session store or raw SQL builder methods.

Patch Information

The issue is fixed in October System versions 3.7.17 and 4.2.21. The patch wraps the Laravel session store in a proxy that exposes only an explicit subset of read/write methods and rejects writes to reserved session key prefixes including admin_auth, october_auth, login_*, _token, and other framework internals. The raw SQL and subquery methods selectRaw, whereRaw, orderByRaw, joinSub, and related calls are now blocked consistently on Query\Builder, Eloquent\Builder, and Eloquent\Model. See the October CMS Security Advisory GHSA-xv9m-fm3w-8w5x for full details.

Workarounds

Restrict CMS markup editing access to fully trusted administrators only, matching the standard October CMS deployment guidance.
Do not disable cms.safe_mode as a workaround. Safe Mode is the boundary this vulnerability affects, and disabling it removes the only sandbox between markup editors and the server.
For multi-tenant or demo deployments that require untrusted editors, upgrade to the patched version before re-enabling backend access.

bash

# Upgrade October CMS system module to a patched release using Composer
composer require october/system:^4.2.21
# or, for the 3.x branch
composer require october/system:^3.7.17

# Verify the installed version
php artisan october:version