THREATOPS
THREAT OPSThreat News › [GHSA] GHSA-r5pm-vrc5-3m73 (low) — cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions

[GHSA] GHSA-r5pm-vrc5-3m73 (low) — cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions

medgithub_advisoriesPublished 2026-08-27

GHSA-r5pm-vrc5-3m73 Severity: low CVE: CVE-2026-54713

cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions

### Impact

For jobs with `shouldBeUnique = true` the queue plugin will generate a 'unique identifier' based on the job class, method and parameters. If user data is supplied, a malicious user could create collisions, resulting in legitimate jobs being dropped.

###

Indicators of compromise

Original source: https://github.com/advisories/GHSA-r5pm-vrc5-3m73