CVE-2021-29487: October CMS October

High severity, CVSS 7.4. EPSS: 0.9% chance of exploitation in the next 30 days.

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can exploit this vulnerability to bypass authentication and takeover of and user account on an October CMS server. The vulnerability is exploitable by unauthenticated users via a specially crafted request. This only affects frontend users and the attacker must obtain a Laravel secret key for cookie encryption and signing in order to exploit this vulnerability. The issue has been patched in Build 472 and v1.1.5.

Affected products

• October CMS October: from 1.0.471, before 1.0.472 (fixed in 1.0.472); from 1.1.1, before 1.1.5 (fixed in 1.1.5)

Published 2021-08-26. Last modified 2026-06-17.