---
id: CVE-2026-115935
title: >-
  Control panel only API response emulation replaces "securityKey" and reaches
  server RCE
summary: "The\_app/process-api-response-headers\_action accepts fake Craft API response headers from any authenticated control panel user.\n\n\n\nA non-admin user with only\_accessCp\_can place newline characters in\_X-Craft-Plugin-Licenses. Craft passes t…"
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-94
vendor: craftcms
product: craftcms/cms
affected:
  - craftcms/cms >= 5.0.0 < 5.11.2
  - craftcms/cms >= 4.0.0 < 4.18.9
published: '2026-10-23'
updated: '2026-10-23'
sourceUpdated: '2026-10-23T21:40:57.592Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115935'
references:
  - url: 'https://www.hckrt.com/hacktivity/HCKRT-WM3VSE'
  - url: 'https://github.com/craftcms/cms/releases/tag/5.11.2'
  - url: 'https://github.com/craftcms/cms'
  - url: 'https://github.com/craftcms/cms/security/advisories/GHSA-9hp6-3565-gvh5'
tags:
  - cve.org
ingestedAt: '2026-10-24T00:46:53.884Z'
---

## Overview

The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user.



A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines.



This lets the user insert a new attacker-known CRAFT_SECURITY_KEY into .env. After Craft loads that key, the user can forge a signed login redirect containing a Twig system() callback.



This is different from the previous report. That report reads the existing key through a Twig sandbox bypass. This report replaces the key through fake API headers and CRLF injection. Fixing either source does not fix the other.

## Affected

- `craftcms/cms >= 5.0.0 < 5.11.2`
- `craftcms/cms >= 4.0.0 < 4.18.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.