Vulnerability · Published Aug 27, 2026 · Assigned by GitHub_M

CVE-2026-54713CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions

Low 3.7

In plain English

A low-severity security flaw in queue from cakephp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.5%top 59.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	cakephp/queue	2.3.1	GHSA-r5pm-vrc5-3m73

Affected products (as reported)

Vendor	Product	Versions
cakephp	queue	>= 0.1.11, < 2.3.1

Weakness: CWE-1023 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References

https://github.com/cakephp/queue/security/advisories/GHSA-r5pm-vrc5-3m73 x_refsource_CONFIRM
https://github.com/cakephp/queue/pull/188 x_refsource_MISC
https://github.com/cakephp/queue/commit/13890591e248acc8824becb24ba1939fa061bd34 x_refsource_MISC
https://github.com/cakephp/queue/releases/tag/2.3.1 x_refsource_MISC