CVE-2026-57855 Cockpit CMS Missing Authorization in Bucket File Storage API
Any authenticated user can perform unauthorized file operations on all buckets due to missing ACL checks in the API.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-57855?
CVE-2026-57855 is a high-severity missing authorization vulnerability in Cockpit CMS, published on 13 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API (/system/buckets/api). The api() method in modules/System/Controller/Buckets.php executes bucket commands (ls, upload, removefiles, rename, createfolder) without performing any ACL or role check. Any authenticated user, regardless of role, can perform all bucket operations on any named bucket, including buckets intended for admin use only.
Weakness: CWE-284
Which versions are affected by CVE-2026-57855?
How do I fix CVE-2026-57855?
No fix has been published for CVE-2026-57855 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-57855 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-57855 exists.
Sources
Also known as GHSA-fjpv-pfvg-c462.