CVE-2026-54713

Deferred Deferred - Pending Action

Queue Job Collision via Parameter Sorting in CakePHP Queue

Publication date: 2026-08-27

Last updated on: 2026-09-09

Assigner: GitHub, Inc.

Description

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-09

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-54713

Affected Vendors & Products

Vendor	Product	Version / Range
cakephp	queue	2.3.1
cakephp	queue	From 0.1.10 (inc) to 2.3.1 (exc)
cakephp	queue	to 2.3.1 (inc)
cakephp	queue	From 0.1.11 (inc) to 2.3.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1023	The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.

Attack-Flow Graph

Executive Summary

CVE-2026-54713 is a flaw in CakePHP Queue's QueueManager::getUniqueId() method. It generates job identifiers by sorting parameter values to ensure uniqueness, but the sorting drops associative-array keys. This allows attackers to submit different data that produces the same identifier, causing legitimate jobs to be incorrectly treated as duplicates and dropped.

Detection Guidance

Check CakePHP Queue library version with: composer show cakephp/queue. If version is between 0.1.11 and 2.3.0, the system is vulnerable. Review application code for jobs using shouldBeUnique=true and inspect parameter handling for potential collision vectors.

Impact Analysis

If you use CakePHP Queue versions 0.1.11 to 2.3.0 with shouldBeUnique enabled, an attacker could manipulate job parameters to cause job collisions. This may result in legitimate jobs being dropped or not executed, disrupting background task processing in your application.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. The issue involves incorrect job deduplication in the CakePHP Queue library, which could lead to legitimate jobs being dropped due to hash collisions. While this may impact system reliability, it does not inherently violate data protection or privacy requirements unless job processing failures result in unauthorized data exposure or processing errors.

Mitigation Strategies

Upgrade CakePHP Queue to version 2.3.1 or later using: composer require cakephp/queue:^2.3.1. Alternatively, disable shouldBeUnique in affected jobs and implement application-level idempotency checks.

Hi! I’m here to help you understand CVE-2026-54713. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70