CVE-2021-41126
Deleted Admin Can Sign In to Admin Interface
October is a Content Management System (CMS) and web platform built on the the Laravel PHP Framework. In affected versions administrator accounts which had previously been deleted may still be able to sign in to the backend using October CMS v2.0. The issue has been patched in v2.1.12 of the october/october package. There are no workarounds for this issue and all users should update.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Deleted Admin Can Sign In to Admin Interface
October is a Content Management System (CMS) and web platform built on the the Laravel PHP Framework. In affected versions administrator accounts which had previously been deleted may still be able to sign in to the backend using October CMS v2.0. The issue has been patched in v2.1.12 of the october/october package. There are no workarounds for this issue and all users should update.
- Record
CVE-2021-41126- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
EUVDEUVD-2021-2170
October is a Content Management System (CMS) and web platform built on the the Laravel PHP Framework. In affected versions administrator accounts which had previously been deleted may still be able to sign in to the backend using October CMS v2.0. The issue has been patched in v2.1.12 of the october/october package. There are no workarounds for this issue and all users should update.
- Record
EUVD-2021-2170- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6gjf-7w99-j7x7
Deleted Admin Can Sign In to Admin Interface
Impact
Assuming an administrator once had previous access to the admin interface, they may still be able to sign in to the backend using October CMS v2.0.
Patches
The issue has been patched in v2.1.12
Workarounds
-
Reset the password of the deleted accounts to prevent them from signing in.
-
Please contact [email protected] for code change instructions if you are unable to upgrade.
References
Credits to: • Daniel Bidala
For more information
If you have any questions or comments about this advisory:
- Email us at [email protected]
- Record
GHSA-6gjf-7w99-j7x7- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
NVD
October is a Content Management System (CMS) and web platform built on the the Laravel PHP Framework. In affected versions administrator accounts which had previously been deleted may still be able to sign in to the backend using October CMS v2.0. The issue has been patched in v2.1.12 of the october/october package. There are no workarounds for this issue and all users should update.
- Record
CVE-2021-41126- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
October is a Content Management System (CMS) and web platform built on the the Laravel PHP Framework. In affected versions administrator accounts which had previously been deleted may still be able to sign in to the backend using October CMS v2.0. The issue has been patched in v2.1.12 of the october/october package. There are no workarounds for this issue and all users should update.
- Record
CVE-2021-41126- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-6gjf-7w99-j7x7
Deleted Admin Can Sign In to Admin Interface
Impact
Assuming an administrator once had previous access to the admin interface, they may still be able to sign in to the backend using October CMS v2.0.
Patches
The issue has been patched in v2.1.12
Workarounds
-
Reset the password of the deleted accounts to prevent them from signing in.
-
Please contact [email protected] for code change instructions if you are unable to upgrade.
References
Credits to: • Daniel Bidala
For more information
If you have any questions or comments about this advisory:
- Email us at [email protected]
- Record
GHSA-6gjf-7w99-j7x7- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
october/octoberPackagist |
2.1.0 up to 2.1.12 | 2.1.12 |
october/systemPackagist |
2.1.0 up to 2.1.12 | 2.1.12 |
october/octoberPackagist |
2.1.0 up to 2.1.12, plus listed versions v2.1.0v2.1.10v2.1.3v2.1.5v2.1.6v2.1.8 |
2.1.12 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-41126 is a high vulnerability (CVSS 7.2) in Octobercms October, published October 6, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.09%, the 65th percentile. Fixed in october/october 2.1.12.