CVE-2021-32648

octobercms october

Published 26 Aug 2021 · updated 17 Jun 2026 · Analyzed

9.1 Critical · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 18 Jan 2022, with a remediation deadline of 1 Feb 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.

References

github.com/octobercms/library/commit/016a297b1bec55d2e53bc889458ed2cb5c3e9374 · Patch
github.com/octobercms/library/commit/5bd1a28140b825baebe6becd4f7562299d3de3b9 · Patch
github.com/octobercms/october/security/advisories/GHSA-mxr5-mc97-63rc · Patch, Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-32648 · US Government Resource