{"id":"CVE-2026-54713","aliases":["EUVD-2026-67241","GHSA-r5pm-vrc5-3m73"],"status":"published","title":"CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions","description":"CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00461,"percentile":0.40426,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1023"],"published":"2026-08-27T17:03:31Z","modified":"2026-10-28T02:30:56Z","fixes":[{"ecosystem":"Packagist","package":"cakephp/queue","fixed_in":["2.3.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"cakephp/queue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.10"},{"fixed":"2.3.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"cakephp/queue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.1.10"},{"fixed":"2.3.1"}]}],"versions":["0.1.10","0.1.11","0.1.12","0.1.13","0.1.14","0.1.15","1.0.0","1.1.0","2.0.1","2.1.0","2.2.0","2.3.0"]}],"products":[{"vendor":"cakephp","product":"queue"}],"references":[{"url":"https://github.com/cakephp/queue/security/advisories/GHSA-r5pm-vrc5-3m73","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/cakephp/queue/pull/188","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/cakephp/queue/commit/13890591e248acc8824becb24ba1939fa061bd34","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/cakephp/queue/releases/tag/2.3.1","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-r5pm-vrc5-3m73"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54713.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54713","tags":["advisory"]},{"url":"https://github.com/cakephp/queue","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-54713","title":"CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions","description":"CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1.","status":"published","published":"2026-08-27T17:03:31.58Z","modified":"2026-08-28T15:55:52.105Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-1023"],"updated_at":"2026-11-02T13:37:58.613221Z"}],"euvd":[{"id":"EUVD-2026-67241","description":"CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1.","status":"published","published":"2026-08-27T17:03:31Z","modified":"2026-08-28T15:55:52Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T18:01:23.104802Z"}],"ghsa":[{"id":"GHSA-r5pm-vrc5-3m73","title":"cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions","description":"### Impact\n\nFor jobs with `shouldBeUnique = true` the queue plugin will generate a 'unique identifier' based on the job class, method and parameters. If user data is supplied, a malicious user could create collisions, resulting in legitimate jobs being dropped.\n\n### Patches\nUpgrade to 2.3.1\n\n### Workarounds\n\nYou can disable `shouldBeUnique` and handle idempotency in application code.","status":"published","published":"2026-08-27T17:03:56Z","modified":"2026-08-27T17:03:57Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-1023"],"updated_at":"2026-11-02T14:41:07.031507Z"}],"nvd":[{"id":"CVE-2026-54713","description":"CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1.","status":"published","published":"2026-08-27T20:17:49.67Z","modified":"2026-09-09T21:09:13.08Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-1023"],"updated_at":"2026-11-02T14:12:42.035353Z"}],"osv":[{"id":"CVE-2026-54713","title":"CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions","description":"CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1.","status":"published","published":"2026-08-27T17:03:31.58Z","modified":"2026-10-28T02:30:56.988215562Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-1023"],"updated_at":"2026-11-02T15:45:10.818486Z"},{"id":"GHSA-r5pm-vrc5-3m73","title":"cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions","description":"### Impact\n\nFor jobs with `shouldBeUnique = true` the queue plugin will generate a 'unique identifier' based on the job class, method and parameters. If user data is supplied, a malicious user could create collisions, resulting in legitimate jobs being dropped.\n\n### Patches\nUpgrade to 2.3.1\n\n### Workarounds\n\nYou can disable `shouldBeUnique` and handle idempotency in application code.","status":"published","published":"2026-08-27T17:03:56Z","modified":"2026-08-27T17:25:39.13265Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-1023"],"updated_at":"2026-11-02T15:46:55.480549Z"}]}}