Deleted Admin Can Sign In to Admin Interface
### Impact Assuming an administrator once had previous access to the admin interface, they may still be able to sign in to the backend using October CMS v2.0. ### Patches The issue has been patched in v2.1.12 ### Workarounds - Reset the password of the deleted accounts to prevent them from signing in. - Please contact hello@octobercms.com for code change instructions if you are unable to upgrade. ### References Credits to: • Daniel Bidala ### For more information If you have any questions or comments about this advisory: * Email us at [hello@octobercms.com](mailto:hello@octobercms.com)
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-41126US | medium6.5 | — | ||
October is a Content Management System (CMS) and web platform built on the the Laravel PHP Framework. In affected versions administrator accounts which had previously been deleted… | ||||
references
External citations — patches, advisories, analysis.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan