Craft CMS authorization bypass in category structure management

Executive brief

Craft CMS, a popular content management system, contains a flaw where users with only 'view' permissions for categories can actually modify the site's category structure. An authenticated user could reorder or re-parent categories, which automatically changes their web addresses (URLs) and can break site navigation and menus. This allows low-privileged users to disrupt the organization and accessibility of website content without proper authorization.

Technical details

An incorrect authorization check (CWE-863) in Craft CMS allows users with 'viewCategories' permissions to perform structure-mutating actions typically reserved for 'saveCategories' holders. The vulnerability exists because the 'structureEditable' flag in 'src/elements/Category.php' is incorrectly derived from view permissions rather than save permissions. When a category index is rendered, the system grants a session-based authorization token that the 'StructuresController' subsequently trusts for 'structures/move-element' actions without re-verifying write privileges. Attackers can exploit this to reorder or re-parent categories, which alters the URI of the affected categories and their descendants. The issue is resolved in version 5.10.6.

Affected products

• Pixel & Tonic Craft CMS >= 5.0.0-RC1, < 5.10.6

Timeline

• 2026-07-25: disclosed
• 2026-08-06: advisory
• 2026-08-06: patched: Fixed in version 5.10.6

References

• https://api.github.com/users/smakarim
• https://github.com/smakarim
• https://api.github.com/users/smakarim/gists%7B/gist_id%7D
• https://api.github.com/users/smakarim/repos
• https://avatars.githubusercontent.com/u/73954294?v=4
• https://api.github.com/users/smakarim/events%7B/privacy%7D