CVE-2026-57855: Cockpit CMS Auth Bypass Vulnerability

CVE-2026-57855 Overview

Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API exposed at /system/buckets/api. The api() method in modules/System/Controller/Buckets.php executes bucket commands including ls, upload, removefiles, rename, and createfolder without performing any Access Control List (ACL) or role check. Any authenticated user, regardless of assigned role, can perform bucket operations against any named bucket, including buckets restricted to administrators. The flaw is categorized under [CWE-284] Improper Access Control and affects Cockpit CMS versions prior to 2.14.0.

Critical Impact
Low-privileged authenticated users can read, upload, rename, and delete files in administrator-only buckets, enabling data theft, tampering, and destruction across the CMS.

Affected Products

Cockpit CMS versions prior to 2.14.0
The Buckets module in modules/System/Controller/Buckets.php
Any deployment exposing the /system/buckets/api endpoint to authenticated users

Discovery Timeline

2026-07-13 - CVE-2026-57855 published to the National Vulnerability Database (NVD)
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-57855

Vulnerability Analysis

Cockpit CMS is a headless content management system that exposes storage buckets for file assets through the Buckets module. The api() controller method dispatches subcommands based on a request parameter and directly invokes the bucket operation handler. Route registration confirms that authentication is required to reach the endpoint, but authorization enforcement is entirely absent from the handler.

As a result, a user with the lowest possible authenticated role can invoke sensitive bucket operations. Available commands include ls for enumeration, upload for arbitrary file placement, removefiles for deletion, rename for renaming, and createfolder for structural changes. The vulnerability affects buckets that were intentionally scoped to administrators, breaking the confidentiality, integrity, and availability boundary between roles.

Root Cause

The root cause is a missing authorization check inside the api() method. The controller trusts that authenticated context alone is sufficient and never validates the caller's role against the target bucket's ACL. This is a canonical [CWE-284] Improper Access Control weakness where the code path executes privileged operations without first evaluating whether the requester holds the required permission.

Attack Vector

Exploitation requires only network access to the Cockpit CMS instance and a valid low-privileged user session. An attacker sends crafted requests to /system/buckets/api specifying the desired command and bucket name. No user interaction from an administrator is needed. A public proof-of-concept script demonstrates enumeration and file manipulation against admin-scoped buckets.

php

<?php

-const APP_VERSION = '2.13.5';
+const APP_VERSION = '2.14.0';

if (!defined('APP_ADMIN')) define('APP_ADMIN', false);
if (!defined('APP_CLI')) define('APP_CLI', PHP_SAPI == 'cli');

Source: GitHub Cockpit Commit dde2d1d. This patch bumps APP_VERSION from 2.13.5 to 2.14.0 and ships the authorization fix for the Buckets controller.

Detection Methods for CVE-2026-57855

Indicators of Compromise

HTTP POST requests to /system/buckets/api originating from non-administrator accounts.
Bucket contents that were modified, renamed, or deleted outside of scheduled administrator activity.
Unexpected files uploaded into admin-only buckets, particularly executable or script content.
Web server access logs showing repeated cmd=ls or cmd=upload parameters against the Buckets API from a single low-privileged session.

Detection Strategies

Enable verbose logging on the Cockpit CMS application to capture the authenticated user identifier alongside every /system/buckets/api request.
Correlate the invoking user's role against the target bucket name and alert when a non-admin account touches an admin-scoped bucket.
Compare file inventories in each bucket against a known-good baseline to identify unauthorized additions or deletions.

Monitoring Recommendations

Forward web server and application logs to a centralized analytics platform and build a rule for high-volume Buckets API calls from a single session.
Monitor filesystem changes in the storage backend that hosts Cockpit bucket data for writes that lack a corresponding administrator session.
Track newly created accounts and role assignments in Cockpit CMS, since exploitation only requires any authenticated account.

How to Mitigate CVE-2026-57855

Immediate Actions Required

Upgrade Cockpit CMS to version 2.14.0 or later, which contains the authorization fix committed in dde2d1d.
Audit all existing user accounts and disable or delete any accounts that are unused, shared, or unnecessary.
Review recent bucket contents for unauthorized uploads, deletions, or renames and restore from backup where required.
Rotate credentials and API tokens that may have been exposed through unauthorized bucket reads.

Patch Information

The fix is delivered in Cockpit CMS 2.14.0. Refer to the GitHub Cockpit Commit dde2d1d for the patch, the GitHub Cockpit Repository for release artifacts, and the VulnCheck Advisory on Cockpit CMS for additional context. A proof-of-concept is documented in this GitHub Gist PoC Script.

Workarounds

Restrict network access to the Cockpit admin interface using a reverse proxy or firewall rule that limits /system/buckets/api to trusted IP ranges.
Temporarily disable non-administrator accounts until the upgrade to 2.14.0 is completed.
Place a web application firewall (WAF) rule in front of /system/buckets/api that denies requests from sessions not tied to an administrator role.

bash

# Example nginx block restricting the Buckets API to trusted admin IPs
location = /system/buckets/api {
    allow 10.0.0.0/24;   # admin network
    deny  all;
    proxy_pass http://cockpit_backend;
}