{"id":"CVE-2021-29487","details":"octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can exploit this vulnerability to bypass authentication and takeover of and user account on an October CMS server. The vulnerability is exploitable by unauthenticated users via a specially crafted request. This only affects frontend users and the attacker must obtain a Laravel secret key for cookie encryption and signing in order to exploit this vulnerability. The issue has been patched in Build 472 and v1.1.5.","aliases":["GHSA-h76r-vgf3-j6w5"],"modified":"2026-10-22T02:47:55.486605992Z","published":"2021-08-26T19:15:07.160Z","database_specific":{},"references":[{"type":"FIX","url":"https://github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374"},{"type":"FIX","url":"https://github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9"},{"type":"FIX","url":"https://github.com/octobercms/october/security/advisories/GHSA-h76r-vgf3-j6w5"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/octobercms/library","events":[{"introduced":"16d8346e40af5da98b454e7fe1810d702a34667e"},{"fixed":"d374aea7c38eb6e103c0faa68ec38a0d36d57fb8"},{"introduced":"717b39b3daee566e1253bdde30754625b63946fe"},{"fixed":"5bd1a28140b825baebe6becd4f7562299d3de3b9"},{"fixed":"016a297b1bec55d2e53bc889458ed2cb5c3e9374"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*","range":[{"introduced":"1.0.471"},{"fixed":"1.0.472"}],"source":"CPE_RANGE"},{"source":"CPE_RANGE","cpe":"cpe:2.3:a:octobercms:october:*:*:*:*:*:*:*:*","range":[{"introduced":"1.1.1"},{"fixed":"1.1.5"}]},{"range":[{"fixed":"016a297b1bec55d2e53bc889458ed2cb5c3e9374"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"5bd1a28140b825baebe6becd4f7562299d3de3b9"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v1.1.4","v1.1.3","v1.1.1","v1.0.471","v1.0.470"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-29487.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"}]}