high8.8

CVE-2026-57855

Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api).

Impact

Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php executes bucket commands (ls, upload, removefiles, rename, createfolder) without performing any ACL or role check. Any authenticated user, regardless of role, can perform all bucket operations on any named bucket, including buckets intended for admin use only.

Affected packages

This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.

Weakness classification

CWE-284

References

NVD record
CVE.org record
https://gist.github.com/sermikr0/821c4edd3c34e98a62a50b07707785bd
https://github.com/Cockpit-HQ/Cockpit/commit/dde2d1d74f5f4e11de42a298918ea8c9684f932c
https://github.com/cockpit-hq/cockpit
https://www.vulncheck.com/advisories/cockpit-cms-missing-authorization-in-bucket-file-storage-api