CVE-2021-32648: October CMS Improper Authentication

Critical severity, CVSS 9.1. Actively exploited: in CISA KEV since 2022-01-18. EPSS: 90.4% chance of exploitation in the next 30 days.

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.

Affected products

• October CMS October: from 1.1.1, before 1.1.5 (fixed in 1.1.5); version 1.0.471 only

Published 2021-08-26. Last modified 2026-06-17.