CVE-2026-46696: October CMS Safe Mode Sandbox Bypass Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-xv9m-fm3w-8w5x",
  "modified" : "2026-09-14T16:02:35Z",
  "published" : "2026-09-14T16:02:35Z",
  "aliases" : [ "CVE-2026-46696" ],
  "summary" : "October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls",
  "details" : "A vulnerability was identified in the Twig sandbox security policy that allowed a chained bypass when `cms.safe_mode` is enabled. The Laravel session store was exposed to Twig with unrestricted method access, and raw SQL methods reachable through Eloquent's `__call` forwarding were not blocked across the full builder chain. When combined, a backend user with CMS markup editing access could read arbitrary database values via raw SQL expressions and write to the backend authentication session key, forging a backend session as another existing user.\n\n**Scope of impact is narrow.** Safe Mode is a niche feature, primarily used for demo installations and multi-tenant or shared-editor scenarios where untrusted users are deliberately granted access to the CMS markup editor. Standard production deployments do not enable Safe Mode, because under normal October CMS guidance backend access - including markup editing - is restricted to trusted administrators, and direct PHP injection through markup is already possible without Safe Mode in that configuration.\n\n**This issue only affects sites that meet all of the following conditions:**\n- `cms.safe_mode` is enabled (a deliberate opt-in for demos or untrusted-editor scenarios)\n- The site has at least one backend user with CMS markup editing access who is not intended to be trusted as a full administrator\n- The site has at least one existing superuser account whose session the lower-privileged user can impersonate\n\n### Impact\n- Arbitrary read access to database tables, including superuser persistence codes from `backend_users`, via raw SQL expressions reachable through `Eloquent\\Model`, `Eloquent\\Builder`, or any allowlisted class that `__call`-forwards to a query builder\n- Forgery of a backend authentication session by writing to the `admin_auth` session key from a Twig template, allowing a markup editor to impersonate an existing superuser\n- Requires authenticated backend access with CMS markup editing permission AND `cms.safe_mode` enabled\n- Not exploitable when Safe Mode is disabled (direct PHP injection through markup is already possible in that configuration, so Safe Mode is the boundary this issue affects)\n\n### Patches\nThe vulnerability has been patched in v3.7.17 and v4.2.21. The Laravel session store is now wrapped in a proxy that exposes only an explicit subset of read/write methods and rejects writes to reserved session key prefixes (`admin_auth`, `october_auth`, `login_*`, `_token`, and other framework internals). Raw SQL and subquery methods (`selectRaw`, `whereRaw`, `orderByRaw`, `joinSub`, and related) are now blocked on `Query\\Builder`, `Eloquent\\Builder`, and `Eloquent\\Model` so the blocklist is consistent across the `__call` forwarding chain. All sites that enable `cms.safe_mode` are encouraged to upgrade to the latest patched version.\n\n### Workarounds\nIf upgrading immediately is not possible:\n- Restrict CMS markup editing access to fully trusted administrators only - the standard October CMS recommendation for any deployment\n- Note that disabling `cms.safe_mode` is **not** a workaround; Safe Mode is the boundary this issue affects, and disabling it removes the only sandbox between markup editors and the server\n\n### References\n- Reported by r00tn0b0dy",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "october/system"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.7.17"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "october/system"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "4.0.0"
      }, {
        "fixed" : "4.2.23"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/octobercms/october/security/advisories/GHSA-xv9m-fm3w-8w5x"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/octobercms/october"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-269", "CWE-284" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-14T16:02:35Z",
    "nvd_published_at" : null
  }
}