CVE-2026-57855 describes an improper access control vulnerability in Cockpit CMS's Bucket file storage API endpoint (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php executes bucket commands (ls, upload, removefiles, rename, createfolder) without performing any access control list (ACL) or role verification. Consequently, any authenticated user, regardless of their assigned role, can execute all bucket operations on any named bucket, including those intended exclusively for administrative use. This lack of authorization checks exposes sensitive file storage operations to unauthorized users.

Any authenticated user can perform all bucket operations on any bucket, including those intended for admin use only. This can lead to unauthorized file access, modification, deletion, or creation within the CMS's file storage system, potentially compromising data integrity and confidentiality. The vulnerability has a CVSS 4.0 score of 8.7, indicating a high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users carefully and consider additional access control mechanisms at the application or network level to limit bucket API usage. Monitor for updates from Cockpit HQ regarding an official patch or mitigation.