CVE-2026-57855 Details
Description
Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php executes bucket commands (ls, upload, removefiles, rename, createfolder) without performing any ACL or role check. Any authenticated user, regardless of role, can perform all bucket operations on any named bucket, including buckets intended for admin use only.
A missing authorization vulnerability has been identified in Cockpit CMS versions prior to 2.14.0, specifically within the Bucket file storage API. The vulnerability allows any authenticated user to perform various bucket operations, such as listing files, uploading, removing files, renaming, and creating folders, on any named bucket. This issue arises because the API method responsible for these operations does not implement any access control or role checks, enabling unauthorized access to buckets designated for admin use only.
Users can update to Cockpit CMS version 2.14.0 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 13, 2026CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/sermikr0/821c4edd3c34e98a62a50b07707785bd | CISA-ADP | BundleExploitRemedy |
| https://gist.github.com/sermikr0/821c4edd3c34e98a62a50b07707785bd | [email protected] | BundleExploitRemedy |
| https://github.com/cockpit-hq/cockpit | [email protected] | Source CodeVendor |
| https://github.com/Cockpit-HQ/Cockpit/commit/dde2d1d74f5f4e11de42a298918ea8c9684f932c | [email protected] | Source CodeVendor |
| https://www.vulncheck.com/advisories/cockpit-cms-missing-authorization-in-bucket-file-storage-api | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Cockpit CMS | < 2.14.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 13, 2026 | New CVE Received | [email protected] |