# CVE-2026-50279: Craft CMS authorship spoofing in EntriesController

Source: https://junglewise.ai/threats/cve-2026-50279-craft-cms-authorship-spoofing-in-entriescontroller  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-50279 · Severity: high · CVSS 4 · Published 2026-07-02

Craft CMS, a popular content management system, contains a vulnerability that allows low-privileged users to change the assigned author of an entry without proper permission. By exploiting a gap in how the system checks permissions during the entry saving process, an authenticated user can reassign content to other users. This can lead to falsified audit trails, unauthorized reassignment of responsibility, and disruption of approval workflows.

Technologies: [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-50279 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50279 being exploited in the wild.

**How severe is CVE-2026-50279?** High severity, with a CVSS score of 4, published 2 July 2026.

**Which products and versions are affected?** craftcms/cms (Packagist) >= 5.0.0-RC1, < 5.9.21, ECOSYSTEM:introduced=5.0.0-RC1,fixed=5.9.21.

**Is there a fix for CVE-2026-50279?** Yes. craftcms/cms (Packagist): upgrade to 5.9.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50279 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-50279?** Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- craftcms/cms (Packagist): upgrade to 5.9.21 or later

  ```sh
  composer require craftcms/cms:^5.9.21
  ```


## Technical details

An improper authorization vulnerability exists in `EntriesController::actionSaveEntry()` due to a 'check-then-act' race-like logic gap. The controller enforces edit permissions on the original entry state before calling `_populateEntryModel()`, which processes attacker-supplied `authors` or `author` parameters. The `canChangeAuthor()` check is evaluated against the old authorship state; if the current user is an existing author, the change is permitted. Because the controller fails to re-verify authorization after the author list is mutated but before the element is saved, a user can reassign authorship to any other user without the `changeAuthorForPeerEntries` permission. This is fixed in version 5.9.21.

## Affected products

- Pixel & Tonic Craft CMS >= 5.0.0-RC1, < 5.9.21

## Identifiers

- CVE-2026-50279
- GHSA-qq2c-2q8j-jh27

## Timeline

- 2026-05-29: disclosed
- 2026-07-02: advisory
- 2026-07-02: patched: Fixed in version 5.9.21

## References

- [https://api.github.com/users/larlarua](https://api.github.com/users/larlarua)
- [https://github.com/larlarua](https://github.com/larlarua)
- [https://api.github.com/users/larlarua/gists%7B/gist_id%7D](https://api.github.com/users/larlarua/gists%7B/gist_id%7D)
- [https://api.github.com/users/larlarua/repos](https://api.github.com/users/larlarua/repos)
- [https://avatars.githubusercontent.com/u/90000267?v=4](https://avatars.githubusercontent.com/u/90000267?v=4)
- [https://api.github.com/users/larlarua/events%7B/privacy%7D](https://api.github.com/users/larlarua/events%7B/privacy%7D)

## Related threats

- [Craft CMS: Stored XSS in the control panel via unescaped draft name](https://junglewise.ai/threats/cve-2026-72787-craft-cms-stored-xss-in-the-control-panel-via-unescaped-draft)
- [Craft CMS: Arbitrary user password reset leading to administrator account takeover](https://junglewise.ai/threats/cve-2026-72786-craft-cms-arbitrary-user-password-reset-leading-to-administrator)
- [Craft CMS authorization bypass in category structure modification](https://junglewise.ai/threats/craft-cms-authorization-bypass-in-category-structure-modification-1555f980)
- [Craft CMS authenticated RCE through Twig sandbox escape](https://junglewise.ai/threats/craft-cms-authenticated-rce-through-twig-sandbox-escape-32ee5ec1)
- [Craft CMS path traversal in ensurePathIsContained](https://junglewise.ai/threats/craft-cms-path-traversal-in-ensurepathiscontained-4adc3058)