High severity · published Jul 13, 2026
CVE-2026-57855
Cockpit CMS Missing Authorization in Bucket File Storage API
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php executes bucket commands (ls, upload, removefiles, rename, createfolder) without performing any ACL or role check. Any authenticated user, regardless of role, can perform all bucket operations on any named bucket, including buckets intended for admin use only.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
Cockpit CMS · Cockpit HQ
before 2.14.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-57855
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-57855
gist.github.com
https://gist.github.com/sermikr0/821c4edd3c34e98a62a50b07707785bd
github.com
https://github.com/Cockpit-HQ/Cockpit/commit/dde2d1d74f5f4e11de42a298918ea8c9684f932c
github.com
https://github.com/cockpit-hq/cockpit
www.vulncheck.com
https://www.vulncheck.com/advisories/cockpit-cms-missing-authorization-in-bucket-file-storage-api
More from Cockpit CMS
8.8
CVE-2026-73680
Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename
8.8
CVE-2026-57856
Cockpit CMS Path Traversal via Bucket Name in Bucket File Storage API