Executive brief
CakePHP Queue is a background job processing plugin for CakePHP applications. The plugin's job deduplication feature uses an incomplete comparison algorithm that fails to account for all aspects of job data, allowing attackers to create identifier collisions that cause legitimate jobs to be lost. This can lead to missed business-critical task execution and application availability issues.
Technical details
The vulnerability exists in the QueueManager::getUniqueId() method, which generates a canonical identifier for jobs with shouldBeUnique=true by sorting job parameters. However, the implementation drops array keys during sorting, allowing different data structures (e.g., {"a":1,"b":2} vs {"b":2,"a":1} with different semantic meanings) to produce identical hashes. This is a classic CWE-1023 incomplete comparison vulnerability. An unauthenticated attacker can craft malicious job parameters to collide with legitimate jobs, causing the queue system to skip execution of the colliding job. The vulnerability requires network access to submit jobs and affects versions >= 0.1.10 through < 2.3.1. A patch is available in version 2.3.1 which implements proper recursive key-aware sorting.
Affected products
- CakePHP Queue >= 0.1.10, < 2.3.1
Timeline
- 2026-06-16: disclosed: Advisory published on GitHub
- 2026-06-09: patched: Version 2.3.1 released with fix
- 2026-08-27: advisory: Published to GitHub Advisory Database
References
- https://github.com/cakephp/queue/security/advisories/GHSA-r5pm-vrc5-3m73
- https://github.com/cakephp/queue/pull/188
- https://github.com/cakephp/queue/commit/13890591e248acc8824becb24ba1939fa061bd34
- https://github.com/cakephp/queue/releases/tag/2.3.1
- https://api.github.com/repos/cakephp/queue/security-advisories/GHSA-r5pm-vrc5-3m73