CVE-2026-54713: CakePHP Queue: Incomplete Comparison in getUniqueId vulnerable to collisions
Impact
For jobs with shouldBeUnique = true the queue plugin will generate a 'unique identifier' based on the job class, method and parameters. If user data is supplied, a malicious user could create collisions, resulting in legitimate jobs being dropped.
Patches Upgrade to 2.3.1
Workarounds
You can disable shouldBeUnique and handle idempotency in application code.
Other sources
CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/cakephp/queueto a version that resolves this vulnerability.Fixed in 2.3.1 - Upgrade
Upgrade
CakePHP Queueto a version that resolves this vulnerability.Fixed in 2.3.1 - Configuration
Disable shouldBeUnique so the queue does not rely on getUniqueId() for de-duplication collisions; handle idempotency in application code instead.
CakePHP Queue plugin shouldBeUnique = false
Event History
Frequently Asked Questions
Which applications are exposed to job loss from this issue?
Applications using the CakePHP queue plugin with jobs configured with shouldBeUnique = true are exposed when user-controlled data is included in the job parameters used to generate the unique identifier.
What must an attacker do to exploit the issue?
An attacker must be able to supply data that becomes part of a unique job's parameters and craft it to collide with the identifier of a legitimate job. A successful collision can cause the legitimate job to be dropped.
Does exploitation require authentication or user interaction?
The supplied vector indicates network reachability, no required privileges, and no user interaction. Exploitation is rated high complexity.
What should teams do if they cannot upgrade immediately?
Disable shouldBeUnique and implement idempotency handling in application code. The available patch is an upgrade to version 2.3.1.