Vulnerability · Published Jul 13, 2026 · Assigned by VulnCheck

CVE-2026-57855Cockpit CMS Missing Authorization in Bucket File Storage API

High 8.8

In plain English

A high-severity improper access control in Cockpit CMS from Cockpit HQ. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 55.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php executes bucket commands (ls, upload, removefiles, rename, createfolder) without performing any ACL or role check. Any authenticated user, regardless of role, can perform all bucket operations on any named bucket, including buckets intended for admin use only.

Affected products (as reported)

Vendor	Product	Versions
Cockpit HQ	Cockpit CMS	0 – before 2.14.0

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Product product
Patch Commit patch
https://gist.github.com/sermikr0/821c4edd3c34e98a62a50b07707785bd technical-description
https://www.vulncheck.com/advisories/cockpit-cms-missing-authorization-in-bucket-file-storage-api third-party-advisory