UpHeron
All vulnerabilities

Servers and applications

CVE-2020-15248

Privilege escalation by backend users assigned to the default "Publisher" system role

Severity
Medium 4.2
Published
22 Nov 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.0.469
Also known as
GHSA-rfjc-xrmf-5vvw
Sources
NVD, Project advisories (GitHub)

Description

October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October CMS from version 1.0.319 and before version 1.0.470, backend users with the default "Publisher" system role have access to create & manage users where they can choose which role the new user has. This means that a user with "Publisher" access has the ability to escalate their access to…

Affected software

SoftwareAffected versions
October CMSServers and applications · cpe:a:octobercms:october
  • From 1.0.319 before 1.0.469
October CMSServers and applications · github:octobercms/october
  • Version 1.1.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-15248
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-15248
  • GitHub Advisory Database https://github.com/advisories/GHSA-rfjc-xrmf-5vvw
  • github.com https://github.com/octobercms/october/security/advisories/GHSA-rfjc-xrmf-5vvw