Is CVE-2026-50279 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50279 being exploited in the wild.

How severe is CVE-2026-50279?

High severity, with a CVSS score of 4, published 2 July 2026.

Which products and versions are affected?

craftcms/cms (Packagist) >= 5.0.0-RC1, < 5.9.21, ECOSYSTEM:introduced=5.0.0-RC1,fixed=5.9.21.

Is there a fix for CVE-2026-50279?

Yes. craftcms/cms (Packagist): upgrade to 5.9.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50279 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-50279?

Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50279: Craft CMS authorship spoofing in EntriesController

Q: Is there a fix for CVE-2026-50279?

Yes. craftcms/cms (Packagist): upgrade to 5.9.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-50279 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-50279?

Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50279 · Severity: high · CVSS 4 · Published 2026-07-02

Craft CMS, a popular content management system, contains a vulnerability that allows low-privileged users to change the assigned author of an entry without proper permission. By exploiting a gap in how the system checks permissions during the entry saving process, an authenticated user can reassign content to other users. This can lead to falsified audit trails, unauthorized reassignment of responsibility, and disruption of approval workflows.

Technologies: craftcms/cms (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-50279 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50279 being exploited in the wild.
How severe is CVE-2026-50279?: High severity, with a CVSS score of 4, published 2 July 2026.
Which products and versions are affected?: craftcms/cms (Packagist) >= 5.0.0-RC1, < 5.9.21, ECOSYSTEM:introduced=5.0.0-RC1,fixed=5.9.21.
Is there a fix for CVE-2026-50279?: Yes. craftcms/cms (Packagist): upgrade to 5.9.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50279 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-50279?: Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

craftcms/cms (Packagist): upgrade to 5.9.21 or later
```
composer require craftcms/cms:^5.9.21
```

Technical details

An improper authorization vulnerability exists in `EntriesController::actionSaveEntry()` due to a 'check-then-act' race-like logic gap. The controller enforces edit permissions on the original entry state before calling `_populateEntryModel()`, which processes attacker-supplied `authors` or `author` parameters. The `canChangeAuthor()` check is evaluated against the old authorship state; if the current user is an existing author, the change is permitted. Because the controller fails to re-verify authorization after the author list is mutated but before the element is saved, a user can reassign authorship to any other user without the `changeAuthorForPeerEntries` permission. This is fixed in version 5.9.21.

Affected products

Pixel & Tonic Craft CMS >= 5.0.0-RC1, < 5.9.21

Identifiers

CVE-2026-50279
GHSA-qq2c-2q8j-jh27

Timeline

2026-05-29: disclosed
2026-07-02: advisory
2026-07-02: patched: Fixed in version 5.9.21

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.