CVE-2026-57855

Name of the Vulnerable Software and Affected Versions Cockpit CMS (affected versions not specified)

Description Missing authorization in the Bucket file storage API endpoint '/system/buckets/api' allows authenticated users to bypass access control. The api() function in modules/System/Controller/Buckets.php executes commands such as ls, upload, removefiles, rename, and createfolder without verifying Access Control Lists (ACL) or user roles. Consequently, any authenticated user can perform all bucket operations on any named bucket, including those reserved for administrators.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.