CVE-2026-54256

MEDIUMPre-NVD 5.45.4
EchelonGraph scoreLOW confidence

This medium-severity CVE scores 5.4 under the CNA's CVSS (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).

Triggered by: NVD CVSS baseline
Sources: cna:github_m
5.4EG
EchelonGraph verdictMonitorLow exploitation likelihood right now — keep watching.
  • Lower severity and no public exploit yet
CISA-KEV: Not listedEPSS PROB: —CVSS: 5.4Exploit: None knownExposed: 0

No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.

Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata

Impact

The backend FileUpload form widget trusted an attacker-controlled file_id POST parameter when resolving the attachment it operates on. The lookup (FileUpload::getFileRecord()) resolved the posted id against the global system_files table without verifying that the file belonged to the widget's own relation, parent record, or deferred-binding session.

Any authenticated backend user who can reach a form containing a fileupload field — including the built-in My Account avatar field, which requires no specific backend permission — could therefore target a System\Models\File record belonging to another user or record and:

  • modify its title and description via onSaveAttachmentConfig, and
  • change its sort_order via onSortAttachments (which passed posted ids
straight to setSortableOrder(), an unscoped UPDATE ... WHERE id = ?).

The same unscoped lookup is reached by onLoadAttachmentConfig, onSaveAttachmentConfig, and onRemoveAttachment. Because all attachments share the single System\Models\File model and system_files table, an attacker was not limited to other users' avatars — any attachment on any model could be referenced by id. Attachment ids are sequential integers and are easily enumerated.

The confirmed impact is unauthorized integrity modification of arbitrary attachment metadata and ordering.

CSRF tokens are still verified on all POST requests, so an attacker must be authenticated to the backend with a valid session. To exploit this issue an attacker needs a backend account with any level of access.

Patches

The FileUpload widget now scopes every file_id lookup to the widget's own relation, including any files bound through the current deferred-binding session, so a posted id can no longer reference an unrelated System\Models\File record:

  • getFileRecord() resolves the id through getRelationObject()->withDeferred($this->sessionKey)->find(...) rather than the global file model. This covers onLoadAttachmentConfig, onSaveAttachmentConfig, and onRemoveAttachment.
  • onSortAttachments() intersects the posted ids with the ids that actually belong to the relation before calling setSortableOrder().

This security issue has been fixed as of v1.2.13 (commit 9cb0ae5f9d837db141ab111c6a7de8eed9603d25).

Workarounds

There is no supported workaround other than upgrading. If you cannot upgrade immediately, you may apply the fix manually in modules/backend/formwidgets/FileUpload.php:

  • In getFileRecord(), replace $this->getRelationModel()->find(post('file_id')) with $this->getRelationObject()->withDeferred($this->sessionKey)->find(post('file_id')).
  • In onSortAttachments(), filter the posted sortOrder ids to those returned by $this->getRelationObject()->withDeferred($this->sessionKey)->pluck($keyName) before calling setSortableOrder().

CVSS v3
5.4
EG Score
5.4(low)
EG Risk
29(Track)
EG Risk 29/100SSVC: Track

EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).

How it’s computed
Severity54% × 45%
Exploitation0% × 40%
Automatability30% × 15%
Action: Routine — remediate on your standard cadence.
EPSS PROB
—
EPSS %ILE
—
KEV
Not listed

Published

August 20, 2026

Last Modified

August 20, 2026

Vendor Advisories for CVE-2026-54256(1)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Data Freshness Timeline

(refreshed 1× in last 7d / 1× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

  1. 2026-08-20 18:42 UTCEG score recompute

Frequently asked(4)

What is CVE-2026-54256?
CVE-2026-54256 is a medium vulnerability published on August 20, 2026. Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata Impact The backend FileUpload form widget trusted an attacker-controlled fileid POST parameter when resolving the attachment it operates on. The lookup (FileUpload::getFileRecord()) resolved the…
When was CVE-2026-54256 disclosed?
CVE-2026-54256 was first published in the National Vulnerability Database on August 20, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
What is the CVSS score of CVE-2026-54256?
CVE-2026-54256 has a CVSS v4.0 base score of 5.4 (CNA self-assessment; NVD's own analysis pending). The EG score is currently aggregating — additional source signals are being incorporated as they become available..
How do I remediate CVE-2026-54256?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-54256, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

Explore the affected products and dependency analysis for CVE-2026-54256

Explore →

Is Your Infrastructure Affected by CVE-2026-54256?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs