CVE-2026-115935

The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user. A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines. This lets the user insert a new attacker-known CRAFT_SECURITY_KEY into .env. After Craft loads that key, the user can forge a signed login redirect containing a Twig system() callback. This is different from the previous report. That report reads the existing key through a Twig sandbox bypass. This report replaces the key through fake API headers and CRLF injection. Fixing either source does not fix the other.

• CWE-94

• https://github.com/craftcms/cms
• https://github.com/craftcms/cms/releases/tag/5.11.2
• https://github.com/craftcms/cms/security/advisories/GHSA-9hp6-3565-gvh5
• https://www.hckrt.com/hacktivity/HCKRT-WM3VSE

Published

Oct 23, 2026

Last Modified

Oct 23, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11591The Widgets for Google Reviews plugin for WordPress is vulne…4.4
• CVE-2026-11592The Email Subscribers & Newsletters – Email Marketing, Post …4.3
• CVE-2026-115929MongoDB Compass relies on Electron, a third-party runtime th…6.8
• CVE-2026-115931Postiz lets a signed-in user ask the backend to run a functi…9.9
• CVE-2026-115932When a post is published, Postiz treats a media path that is…9.6
• CVE-2026-115933Postiz signs its session, invitation and password reset toke…9.9
• CVE-2026-115937The Mollie webhook endpoint accepts two independent, attacke…7.5
• CVE-2026-115938Craft CMS allows any authenticated control panel user to sub…8.8
• CVE-2026-11594IBM WebSphere Application Server 9.0, and 8.5 is affected by…6.1
• CVE-2026-11595IBM WebSphere Application Server 9.0, and 8.5 could allow a …7.5
• CVE-2026-11596In ScreenConnect™ versions prior to 26.2, input validation w…4.7
• CVE-2026-115969A flaw has been found in Travisun Opptrix 0.4.0. This affect…7.3