Is CVE-2026-46696 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-46696 being exploited in the wild.

How severe is CVE-2026-46696?

Low severity, with a CVSS score of 3.3, published 14 September 2026.

Which products and versions are affected?

october/system (Packagist) ECOSYSTEM:introduced=0,fixed=3.7.17.

Is there a fix for CVE-2026-46696?

Yes. october/system (Packagist): upgrade to 3.7.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-46696 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-46696?

Check whether you run october/system (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-46696: October CMS Twig sandbox bypass in Safe Mode

CVE-2026-46696 · Severity: low · CVSS 3.3 · Published 2026-09-14

October CMS contains a vulnerability in its Safe Mode sandbox feature that allows a backend editor with markup-editing permissions to bypass security restrictions. An attacker could read sensitive database data (including superuser credentials) and forge backend authentication sessions to impersonate administrators. This only affects installations where Safe Mode is explicitly enabled—a deliberate opt-in for demo or multi-tenant scenarios where untrusted users have editor access.

Technologies: october/system (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-46696 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-46696 being exploited in the wild.
How severe is CVE-2026-46696?: Low severity, with a CVSS score of 3.3, published 14 September 2026.
Which products and versions are affected?: october/system (Packagist) ECOSYSTEM:introduced=0,fixed=3.7.17.
Is there a fix for CVE-2026-46696?: Yes. october/system (Packagist): upgrade to 3.7.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-46696 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-46696?: Check whether you run october/system (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

october/system (Packagist): upgrade to 3.7.17 or later
```
composer require october/system:^3.7.17
```

Technical details

The vulnerability is a chained sandbox bypass in October CMS's Twig sandbox when `cms.safe_mode` is enabled. The Laravel session store was exposed to Twig with unrestricted method access, and raw SQL methods (selectRaw, whereRaw, orderByRaw, joinSub) reachable through Eloquent's `__call` forwarding were not blocked across the full builder chain. A backend user with CMS markup editing permissions could chain these to read arbitrary database tables via raw SQL expressions and write to the `admin_auth` session key to forge a backend session. Attack requires: (1) `cms.safe_mode` enabled, (2) authenticated backend access with markup editing permission, (3) at least one existing superuser account. The fix patches v3.7.17 and v4.2.23+ by wrapping the session store in a proxy with restricted method access and blocking raw SQL methods on Query\Builder, Eloquent\Builder, and Eloquent\Model.

Affected products

October CMS October CMS < 3.7.17; >= 4.0.0, < 4.2.23

Identifiers

CVE-2026-46696
GHSA-xv9m-fm3w-8w5x

Timeline

2026-09-14: disclosed: Vulnerability published by GitHub Advisory Database
2026-09-14: patched: Patches released in v3.7.17 and v4.2.23

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.