CVE-2026-57855

HIGH 8.8

Cockpit CMS Missing Authorization in Bucket File Storage API

CVSS Score

8.8

EPSS Score

0.3%

EPSS Percentile

20th

Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php executes bucket commands (ls, upload, removefiles, rename, createfolder) without performing any ACL or role check. Any authenticated user, regardless of role, can perform all bucket operations on any named bucket, including buckets intended for admin use only.

CWE	CWE-284
Vendor	cockpit hq
Product	cockpit cms
Published	Jul 13, 2026
Last Updated	Jul 14, 2026

Stay Ahead of the Next One

Get instant alerts for cockpit hq cockpit cms

Be the first to know when new high vulnerabilities affecting cockpit hq cockpit cms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

Cockpit HQ / Cockpit CMS

0 < 2.14.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/cockpit-hq/cockpit github.com: https://github.com/Cockpit-HQ/Cockpit/commit/dde2d1d74f5f4e11de42a298918ea8c9684f932c gist.github.com: https://gist.github.com/sermikr0/821c4edd3c34e98a62a50b07707785bd vulncheck.com: https://www.vulncheck.com/advisories/cockpit-cms-missing-authorization-in-bucket-file-storage-api

Credits

Saidakbarxon Maxsudxonov