CVE-2026-54713

Name of the Vulnerable Software and Affected Versions CakePHP Queue versions 0.1.11 through 2.3.0

Description In the QueueManager::getUniqueId() function, identifiers for jobs with shouldBeUnique enabled are generated using the job class, method, and parameters. However, the process of sorting parameter values removes associative-array keys. An unauthenticated attacker capable of influencing job parameters can submit semantically different data that generates the same identifier, causing legitimate jobs to be dropped due to duplicate collisions.

Recommendations Update to version 2.3.1. Disable shouldBeUnique and handle idempotency within the application code.