Executive brief
Craft CMS is a popular content management system used to build websites and manage digital content. A flaw allows authenticated users with read-only access to category groups to permanently restructure the category taxonomy by reordering and moving categories. Since category URLs are derived from their position in the structure, these unauthorized changes alter page URLs for categories and their descendants, potentially breaking navigation menus and corrupting site structure—even though the user should not have permission to make such modifications.
Technical details
This is an incorrect authorization vulnerability (CWE-863) in Craft CMS where the structureEditable flag is incorrectly computed from the viewCategories permission instead of the saveCategories permission. The vulnerable StructuresController authorizes the mutating structures/move-element action solely on a session grant established at read-time, without performing a save-permission re-check. An authenticated control-panel user holding only view-only access to a category group can exploit this to permanently reorder and re-parent categories. Because category URIs are derived from their position in the structure hierarchy, moving a category changes its URL and those of all descendants, corrupting any navigation or menus built from the category taxonomy. This is a distinct instance of the same authorization-check flaw pattern fixed in earlier versions 5.10.3 and 5.10.5. The fix is available in version 5.10.6.
Affected products
- Craft CMS cms 5.0.0-RC1 through 5.10.5
Timeline
- 2026-07-25: disclosed: GHSA-xxpx-f366-4xpq initially published
- 2026: patched: Fix released in version 5.10.6