cms: Control panel only API response emulation replaces "securityKey" and reaches server RCE
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Reports 2
1 outlet mention it. Reports are not confirmation; each links to its source.
- @stackflag.bsky.social: CVE-2026-115935 - cms A user who can log into the Craft CMS control panel can send specially crafted API headers that change the secret security key stored in the site's .env file.Bluesky: CVE posts, 24 Oct 2026
- @thehackerwire.bsky.social: 🟠 CVE-2026-115935 - High (8.8) The app/process-api-response-headers action accepts fake Craft API response headers from any au... https://www.thehackerwire.com/vulnerability/CVE-20Bluesky: CVE posts, 23 Oct 2026
Description
The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user.
A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines.
This lets the user insert a new attacker-known CRAFT_SECURITY_KEY into .env. After Craft loads that key, the user can forge a signed login redirect containing a Twig system() callback.
This is different from the previous report. That report reads the existing key through a Twig sandbox bypass. This report replaces the key through fake API headers and CRLF injection. Fixing either source does not fix the other.
Text from CVE List
Affected versions 2
- cmsaffected: 5.0.0 before 5.11.2CVE List
- cmsaffected: 4.0.0 before 4.18.9CVE List