The vulnerable function creates job identifiers by concatenating the job class, method, and parameter values, but it discards associative‑array keys when sorting the parameters. An attacker who can submit job parameters that are semantically different yet yield the same identifier can force legitimate jobs to be dropped as duplicates. This failure of uniqueness can delay, skip, or improperly schedule critical background work such as data imports, email notifications, or batch processing, effectively sabotaging application functionality.

The issue affects the CakePHP Queue library from version 0.1.11 up to but excluding 2.3.1. The library is used as a queue‑interop compatible service in CakePHP applications. Users of any of these affected releases should verify the version of the queue component they are running.

The CVSS score of 3.7 indicates moderate impact. No EPSS data is available and the vulnerability is not yet listed in the CISA KEV catalog. The likely attack vector is any user that can influence job parameters without authentication; this could be through an unprotected API endpoint or a compromised web application that submits jobs. Exploiting the collision weakness can result in legitimate jobs being suppressed as duplicates, causing loss of functionality and potential data integrity problems. The vulnerability does not grant code execution or privilege escalation.