# CVE-2026-54713: CakePHP Queue incomplete comparison in getUniqueId

Source: https://junglewise.ai/threats/cve-2026-54713-cakephp-queue-incomplete-comparison-in-getuniqueid  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-54713 · Severity: low · CVSS 3.7 · Published 2026-08-27

CakePHP Queue is a background job processing plugin for CakePHP applications. The plugin's job deduplication feature uses an incomplete comparison algorithm that fails to account for all aspects of job data, allowing attackers to create identifier collisions that cause legitimate jobs to be lost. This can lead to missed business-critical task execution and application availability issues.

Vendors: [Cakephp](https://junglewise.ai/threats/vendors/cakephp), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-54713 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54713 being exploited in the wild.

**How severe is CVE-2026-54713?** Low severity, with a CVSS score of 3.7, published 27 August 2026.

**Which products and versions are affected?** Cakephp Queue >= 0.1.10, < 2.3.1; cakephp/queue (Packagist) >= 0.1.10, < 2.3.1, ECOSYSTEM:introduced=0.1.10,fixed=2.3.1.

**Is there a fix for CVE-2026-54713?** Yes. cakephp/queue (Packagist): upgrade to 2.3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54713 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54713?** Check whether you run Cakephp Queue or cakephp/queue (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- cakephp/queue (Packagist): upgrade to 2.3.1 or later

  ```sh
  composer require cakephp/queue:^2.3.1
  ```


## Technical details

The vulnerability exists in the QueueManager::getUniqueId() method, which generates a canonical identifier for jobs with shouldBeUnique=true by sorting job parameters. However, the implementation drops array keys during sorting, allowing different data structures (e.g., {"a":1,"b":2} vs {"b":2,"a":1} with different semantic meanings) to produce identical hashes. This is a classic CWE-1023 incomplete comparison vulnerability. An unauthenticated attacker can craft malicious job parameters to collide with legitimate jobs, causing the queue system to skip execution of the colliding job. The vulnerability requires network access to submit jobs and affects versions >= 0.1.10 through < 2.3.1. A patch is available in version 2.3.1 which implements proper recursive key-aware sorting.

## Affected products

- CakePHP Queue >= 0.1.10, < 2.3.1

## Identifiers

- CVE-2026-54713
- GHSA-r5pm-vrc5-3m73

## Timeline

- 2026-06-16: disclosed: Advisory published on GitHub
- 2026-06-09: patched: Version 2.3.1 released with fix
- 2026-08-27: advisory: Published to GitHub Advisory Database

## References

- [https://github.com/cakephp/queue/security/advisories/GHSA-r5pm-vrc5-3m73](https://github.com/cakephp/queue/security/advisories/GHSA-r5pm-vrc5-3m73)
- [https://github.com/cakephp/queue/pull/188](https://github.com/cakephp/queue/pull/188)
- [https://github.com/cakephp/queue/commit/13890591e248acc8824becb24ba1939fa061bd34](https://github.com/cakephp/queue/commit/13890591e248acc8824becb24ba1939fa061bd34)
- [https://github.com/cakephp/queue/releases/tag/2.3.1](https://github.com/cakephp/queue/releases/tag/2.3.1)
- [https://api.github.com/repos/cakephp/queue/security-advisories/GHSA-r5pm-vrc5-3m73](https://api.github.com/repos/cakephp/queue/security-advisories/GHSA-r5pm-vrc5-3m73)