CVE-2021-41126: octobercms october

csirt@kutim:~/threat-intel/cve/CVE-2021-41126

CVSS 7.2 · High EPSS 1,1%

Kerentanan Improper Authentication pada octobercms october. Skor CVSS 3.1 7.2 (High) menurut github.com.

Deskripsi (NVD)

October is a Content Management System (CMS) and web platform built on the the Laravel PHP Framework. In affected versions administrator accounts which had previously been deleted may still be able to sign in to the backend using October CMS v2.0. The issue has been patched in v2.1.12 of the october/october package. There are no workarounds for this issue and all users should update.

Rincian

Terbit di NVD: 6 Oktober 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.2 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-287: Improper Authentication
EPSS (30 hari): 1,1% peluang dieksploitasi; lebih tinggi dari 64,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
octobercms	october	Versi 2.0.0 hingga sebelum 2.1.12

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://octobercms.com/changelog release notes · advisory vendor
https://github.com/octobercms/october/security/advisories/GHSA-6gjf-7w99-j7x7 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.