CVE-2026-54713

3.7 lowEPSS 0.5%

Low (3.7). EPSS 0.5% chance of exploitation in the next 30 days.

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1.

Severity

CVSS 3.1

3.7 low

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
CWE: CWE-1023
Published: 2026-08-27
Modified: 2026-09-09
Record from: the NVD, synced 2026-10-19

References

https://github.com/cakephp/queue/commit/13890591e248acc8824becb24ba1939fa061bd34
https://github.com/cakephp/queue/pull/188
https://github.com/cakephp/queue/releases/tag/2.3.1
https://github.com/cakephp/queue/security/advisories/GHSA-r5pm-vrc5-3m73

Check your stack JSON