CVE-2026-54713: CWE-1023: Incomplete Comparison with Missing Factors in cakephp queue
Description
CVE-2026-54713 is a low-severity vulnerability in CakePHP Queue versions from 0.1.11 up to but not including 2.3.1. The issue arises because the QueueManager::getUniqueId() method generates job identifiers by sorting parameter values but drops associative-array keys, causing semantically different job parameters to produce identical identifiers. This can lead to legitimate jobs being incorrectly dropped as duplicates when the shouldBeUnique feature is enabled. The vulnerability is fixed in version 2.3.1.
CVSS v3.1
Score 3.7low
Affected software
cakephp
queue
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CakePHP Queue's QueueManager::getUniqueId() method, in versions 0.1.11 through 2.3.0, generates unique job identifiers from the job class, method, and parameters. However, the sorting of parameter values drops associative-array keys, causing different parameter sets to yield the same identifier. An unauthenticated attacker able to influence job parameters can exploit this to cause legitimate jobs to be dropped due to duplicate collision. The issue is resolved in version 2.3.1.
Potential Impact
The vulnerability can cause legitimate jobs to be dropped as duplicates when the shouldBeUnique flag is enabled, potentially leading to denial of service or loss of job processing. There is no impact on confidentiality or integrity, and the attack requires high attack complexity with no privileges or user interaction. No known exploits are reported in the wild.
Mitigation Recommendations
Upgrade to CakePHP Queue version 2.3.1 or later, where this issue is fixed. No other mitigations are indicated. Patch status is not explicitly stated in vendor advisories but the description confirms the fix in 2.3.1.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-15T22:58:06.563Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a909cf4acd9273b49b2cdd4
Added to database: 08/27/2026, 20:24:20 UTC
Last enriched: 09/10/2026, 04:24:12 UTC
Last updated: 10/10/2026, 18:48:20 UTC
Views: 57
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.