{"id":"GHSA-r5pm-vrc5-3m73","aliases":["CVE-2026-54713"],"title":"cakephp/queue's Incomplete Comparison in getUniqueId vulnerable to collisions","description":"### Impact\n\nFor jobs with `shouldBeUnique = true` the queue plugin will generate a 'unique identifier' based on the job class, method and parameters. If user data is supplied, a malicious user could create collisions, resulting in legitimate jobs being dropped.\n\n### Patches\nUpgrade to 2.3.1\n\n### Workarounds\n\nYou can disable `shouldBeUnique` and handle idempotency in application code.","severity":"low","score":3.7,"published":"2026-08-27T17:03:56.000Z","modified":"2026-08-27T17:25:39.132Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"cakephp/queue","ranges":[{"events":[{"introduced":"0.1.10"},{"fixed":"2.3.1"}],"type":"ECOSYSTEM"}],"versions":["0.1.10","0.1.11","0.1.12","0.1.13","0.1.14","0.1.15","1.0.0","1.1.0","2.0.1","2.1.0","2.2.0","2.3.0"],"fixed":["2.3.1"]}],"references":["https://github.com/cakephp/queue/security/advisories/GHSA-r5pm-vrc5-3m73","https://github.com/cakephp/queue/pull/188","https://github.com/cakephp/queue/commit/13890591e248acc8824becb24ba1939fa061bd34","https://github.com/cakephp/queue","https://github.com/cakephp/queue/releases/tag/2.3.1"],"sources":[{"name":"OSV","id":"GHSA-r5pm-vrc5-3m73","modified":"2026-08-27T17:25:39.132650Z","url":"https://osv.dev/vulnerability/GHSA-r5pm-vrc5-3m73"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","score":3.7}]}