Craft CMS authorization bypass in category structure modification

Severity: medium · CVSS 4.3 · Published 2026-08-11

Craft CMS is a popular content management system used to build websites and manage digital content. A flaw allows authenticated users with read-only access to category groups to permanently restructure the category taxonomy by reordering and moving categories. Since category URLs are derived from their position in the structure, these unauthorized changes alter page URLs for categories and their descendants, potentially breaking navigation menus and corrupting site structure—even though the user should not have permission to make such modifications.

Technologies: craftcms/cms (Packagist). Vendors: Packagist.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 4.3, published 11 August 2026.
Which products and versions are affected?
craftcms/cms (Packagist) >= 5.0.0-RC1, < 5.10.6.
Is there a fix for This vulnerability?
A patch was published on 2026: Fix released in version 5.10.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a web application.
Am I affected?
Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an incorrect authorization vulnerability (CWE-863) in Craft CMS where the structureEditable flag is incorrectly computed from the viewCategories permission instead of the saveCategories permission. The vulnerable StructuresController authorizes the mutating structures/move-element action solely on a session grant established at read-time, without performing a save-permission re-check. An authenticated control-panel user holding only view-only access to a category group can exploit this to permanently reorder and re-parent categories. Because category URIs are derived from their position in the structure hierarchy, moving a category changes its URL and those of all descendants, corrupting any navigation or menus built from the category taxonomy. This is a distinct instance of the same authorization-check flaw pattern fixed in earlier versions 5.10.3 and 5.10.5. The fix is available in version 5.10.6.

Affected products

  • Craft CMS cms 5.0.0-RC1 through 5.10.5

Timeline

  • 2026-07-25: disclosed: GHSA-xxpx-f366-4xpq initially published
  • 2026: patched: Fix released in version 5.10.6

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.