CVE-2026-105858

Summary

A remote code execution vulnerability exists in a headless CMS where an attacker can execute arbitrary code by sending a crafted request to the public first-register endpoint when local authentication is enabled and no initial user exists. This allows full system compromise with high severity.

Exploitability

Exploitation requires a single crafted HTTP request to the public registration endpoint, but depends on specific preconditions: local authentication must be enabled and no initial user must exist in the system.

Blast radius

The vulnerability affects installations using local authentication without an initial user account, potentially allowing attackers to gain full control over the CMS server and execute arbitrary commands with the privileges of the web application.

Detection

Monitor for unusual POST requests to the /register endpoint with malformed payloads that trigger code execution, particularly when local authentication is enabled and no initial user exists in the system logs.

Prioritized remediation

Upgrade to version 3.90.0 or later, or upgrade to 4.0.0-canary.34 if using canary versions.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.