ZeroDay Findings
Sign inSign up

Findings

CVE-2021-32648

October CMS Improper Authentication

Published Aug 26, 2021 · updated Jun 16, 2026 · octobercms october

octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 26, 2021 · Catalog

    Detected

    octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.

  2. Jan 18, 2022 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Feb 1, 2022 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and v1.1.5.

Required action

Apply updates per vendor instructions.

CISA due date Feb 1, 2022

Affected

  • cpe octobercms/octoberversion unspecified
  • cpe octobercms/october1.0.471
  • vendor October CMS October CMSversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2021-32648

    In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2021-32648

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2021-32648

    30-day exploitation probability 90.4%

    first.org
  • NIST NVDVulnerability recordCVE-2021-32648

    octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system package an attacker can request an account password reset and then gain access to the account using a specially crafted request. The issue has been patched in Build 472 and

    nvd.nist.gov

References