Cockpit HQ - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/cockpit-hq/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 13 Jul 2026 23:18:01 +0000Cockpit CMS Missing Authorization Vulnerability in Bucket File Storage API (CVE-2026-57855)https://feed.craftedsignal.io/briefs/2026-07-cockpit-cms-auth-bypass/Mon, 13 Jul 2026 23:18:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-cockpit-cms-auth-bypass/A missing authorization vulnerability, CVE-2026-57855, in the Cockpit CMS Bucket file storage API allows any authenticated user, regardless of their assigned role, to perform all file operations on any named bucket, including those designated for administrative use, potentially leading to privilege escalation, data manipulation, or data destruction.CVE-2026-57855 describes a critical missing authorization vulnerability within the Cockpit CMS Bucket file storage API. Specifically, the api() method located in modules/System/Controller/Buckets.php fails to implement proper Access Control List (ACL) or role-based checks before executing various bucket commands such as ls, upload, removefiles, rename, and createfolder. This flaw enables any authenticated user, even those with low privileges, to bypass intended security restrictions and perform arbitrary file operations on any named bucket, including sensitive administrative buckets. The vulnerability, discovered by VulnCheck, has a CVSS v3.1 base score of 8.8, indicating a high potential for impact. If exploited, an attacker could gain unauthorized access to data, manipulate website content, delete critical files, or potentially achieve remote code execution by uploading malicious scripts into web-accessible directories, thereby escalating their privileges within the CMS environment.

Attack Chain

  1. An adversary obtains valid but low-privileged credentials for a Cockpit CMS instance.
  2. The adversary authenticates to the Cockpit CMS web interface or directly interacts with its API.
  3. The adversary crafts an HTTP request targeting the /system/buckets/api endpoint.
  4. The request includes a bucket operation command (e.g., upload, removefiles, createfolder) and specifies a target bucket, potentially an administrator-only bucket.
  5. The api() method in modules/System/Controller/Buckets.php processes the request and executes the command.
  6. Due to the missing authorization checks, the system fails to verify the user's role or permissions for the requested operation or target bucket.
  7. The command is executed successfully, allowing the adversary to perform unauthorized actions such as uploading web shells, deleting critical site files, or modifying configuration data.
  8. This leads to privilege escalation, data destruction, data manipulation, or potentially arbitrary code execution on the Cockpit CMS server.

Impact

Successful exploitation of CVE-2026-57855 can lead to severe consequences for organizations utilizing Cockpit CMS. The primary impact is unauthorized access to and manipulation of sensitive data. Attackers can upload malicious files, leading to potential website defacement or arbitrary code execution if a web shell is deployed. Furthermore, adversaries can delete or rename critical system files, causing denial of service, data loss, or inhibiting system recovery. The vulnerability also facilitates privilege escalation, allowing low-privileged authenticated users to gain administrative capabilities, take full control of the CMS, and potentially pivot to other systems within the network. While no specific victim count or targeted sectors are provided, any organization running affected versions of Cockpit CMS is at risk.

Recommendation

  • Patch Cockpit CMS instances to version 2.14.0 or newer immediately to address CVE-2026-57855, as indicated by the fix in https://github.com/Cockpit-HQ/Cockpit/commit/dde2d1d74f5f4e11de42a298918ea8c9684f932c.
  • Implement robust monitoring of web server logs for suspicious activity directed at the /system/buckets/api endpoint, particularly for requests originating from low-privileged user accounts.
  • Monitor file system integrity and changes within Cockpit CMS installation directories and associated bucket storage locations for unauthorized file uploads, deletions, or modifications.
  • Regularly review user accounts and their assigned roles within Cockpit CMS to ensure the principle of least privilege is strictly enforced.
]]>highadvisoryvulnerabilityweb-applicationcmsauthorization-bypassprivilege-escalation