---
id: CVE-2026-54713
title: CakePHP Queue is a queue-interop compatible queueing library
summary: >-
  CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11
  until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with
  shouldBeUnique enabled from the job class, method, and parameters, but sorting
  paramet…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-1023
vendor: cakephp
product: cakephp/queue
affected:
  - 'cakephp/queue >= 0.1.10, < 2.3.1'
patched:
  - cakephp/queue 2.3.1
published: '2026-08-27'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:09:13.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-54713'
references:
  - url: >-
      https://github.com/cakephp/queue/commit/13890591e248acc8824becb24ba1939fa061bd34
    label: security-advisories@github.com
  - url: 'https://github.com/cakephp/queue/pull/188'
    label: security-advisories@github.com
  - url: 'https://github.com/cakephp/queue/releases/tag/2.3.1'
    label: security-advisories@github.com
  - url: 'https://github.com/cakephp/queue/security/advisories/GHSA-r5pm-vrc5-3m73'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-r5pm-vrc5-3m73'
tags:
  - nvd
  - ghsa
  - composer
epss: 0.00461
epssPercentile: 0.37315
aliases:
  - GHSA-r5pm-vrc5-3m73
ecosystem: composer
ingestedAt: '2026-08-27T17:05:19.909Z'
---

## Overview

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. This issue is fixed in version 2.3.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-54713)

Affected packages:

- `cakephp/queue >= 0.1.10, < 2.3.1`

Patched in:

- `cakephp/queue 2.3.1`

Source: https://github.com/advisories/GHSA-r5pm-vrc5-3m73