AIKIDO-2025-10653
cakephp/cakephp is vulnerable to Improper Authorization
50
Medium Risk
This Affects:
cakephp/cakephpTL;DR
Certain versions of CakePHP could incorrectly generate SQL when embedding a subquery that was already executed. This could cause access control conditions (WHERE clauses, bindings) to be lost or mishandled, leading to unauthorized data exposure or bypassing logic checks.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
cakephp/cakephp is vulnerable to Improper Authorization in versions 3.2.6 - 5.2.7.
How to fix this
Upgrade cake/cakephp to the patch version. A patch for 4.X is currently unavailable.
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant