CVE-2026-26274

October: Safe Mode Bypass via Twig Database Write Operations

State: Published
Severity: 6.6 Medium
Published: Apr 21, 2026
Updated: Apr 21, 2026
Reserved: Feb 12, 2026

Description

October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a vulnerability was identified in the Twig sandbox security policy that allowed database write operations when cms.safe_mode is enabled. Backend users with Developer permissions could use Twig template markup to execute insert, update, and delete operations on any database table through the query builder, which is included in the sandbox allow-list. This vulnerability is fixed in 3.7.14 and 4.1.10.

Scores

CVSS	Score	Vector	Source
3.1	6.6 Medium	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-184 Incomplete List of Disallowed Inputs
CWE-863 Incorrect Authorization

Affected Products

Product	Versions
octoberoctobercms	>= 4.0.0, < 4.1.10Affected < 3.7.14Affected

References

https://github.com/octobercms/october/security/advisories/GHSA-h6jm-f4hh-fw27

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.