Volker Dusch

**Name of the Vulnerable Software and Affected Versions** CakePHP Queue versions 0.1.11 through 2.3.0 **Description** In the `QueueManager::getUniqueId()` function, identifiers for jobs with `shouldBeUnique` enabled are generated using the job class, method, and parameters. However, the process of sorting parameter values removes associative-array keys. An unauthenticated attacker capable of influencing job parameters can submit semantically different data that generates the same identifier, causing legitimate jobs to be dropped due to duplicate collisions. **Recommendations** Update to version 2.3.1. Disable `shouldBeUnique` and handle idempotency within the application code.