Craftcms
CVE-2026-115935: The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only acc
CVE-2026-115935 Oct 23, 2026 Source: Vendor
The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user.
A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines.
This lets the user insert a new attacker-known CRAFT_SECURITY_KEY into .env. After Craft loads that key, the user can forge a signed login redirect containing a Twig system() callback.
This is diff
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-115935
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
1 line
Showing 1–1 of 1
CVE-2026-115935
BR2026-0000-031535
unclaimed
Credited as Mohamed Wagdy