October System vulnerabilities

CVE-2024-24764 [LOW] CWE-601 October System module has an Open Redirect for Administrator Accounts October System module has an Open Redirect for Administrator Accounts ### Impact This advisory affects authenticated administrators who may be redirected to an untrusted URL using the PageFinder schema. The resolver for the page finder link schema (`october://`) allowed external links, therefore allowing an open redirect outside the scope of the active host. This vulnerability assumes a trusted

CVE-2026-29179 [LOW] CWE-863 October CMS: Editor Sub-Permission Bypass for Asset and Blueprint File Operations October CMS: Editor Sub-Permission Bypass for Asset and Blueprint File Operations Fine-grained sub-permission checks for asset and blueprint file operations were not enforced in the CMS and Tailor editor extensions. This only affects backend users who were explicitly granted `editor` access but had `editor.cms_assets` or `editor.tailor_blueprints` specifically withheld, an uncommon per

CVE-2026-27937 [LOW] CWE-79 October CMS: Reflected XSS via DataTable Form Widget October CMS: Reflected XSS via DataTable Form Widget A reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping. ### Impact - Reflected XSS only, no stored/persistent component - The backend URL prefix is customizable and must be known or guessed by the attacker - Requires an authenticated backend user to v