The vulnerability in the Bucket file storage API of Cockpit CMS allows any authenticated user to perform a range of bucket commands—listing, uploading, deleting, renaming, and creating folders—without any authorization audit. This is a missing authorization weakness (CWE-284). This effectively grants users full control over any bucket, including those reserved for administrative use. The potential impact includes unauthorized data exposure, tampering, or deletion, which can compromise confidentiality, integrity, and availability of the application’s stored assets.

Cockpit HQ’s Cockpit CMS is affected. Version information for vulnerable releases is not provided; the flaw exists in unpatched modules/System/Controller/Buckets.php. The API path involved is /system/buckets/api.

The CVSS score of 8.7 places this flaw in the High severity range, indicating a substantial risk. The EPSS score of < 1% indicates a very low but nonzero probability of exploitation, and the issue is not listed known active exploitation yet. The main attack vector is an authenticated attacker who may have any role; thus the threat surface wide, as every logged‑in user can exploit the feature until a fix or mitigation is applied.