high7.2
CVE-2021-41126
Deleted Admin Can Sign In to Admin Interface
Impact
### Impact Assuming an administrator once had previous access to the admin interface, they may still be able to sign in to the backend using October CMS v2.0. ### Patches The issue has been patched in v2.1.12 ### Workarounds - Reset the password of the deleted accounts to prevent them from signing in. - Please contact hello@octobercms.com for code change instructions if you are unable to upgrade. ### References Credits to: • Daniel Bidala ### For more information If you have any questions or comments about this advisory: * Email us at [hello@octobercms.com](mailto:hello@octobercms.com)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | october/october | >= 2.1.0, < 2.1.12 | 2.1.12 |
| composer | october/system | >= 2.1.0, < 2.1.12 | 2.1.12 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Octobercms | October | from 2.0.0 before 2.1.12 |