Is CVE-2026-50280 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-50280 being exploited in the wild.

How severe is CVE-2026-50280?

Medium severity, with a CVSS score of 4, published 2 July 2026.

Which products and versions are affected?

craftcms/cms (Packagist) >= 5.0.0-RC1, < 5.9.21, ECOSYSTEM:introduced=5.0.0-RC1,fixed=5.9.21.

Is there a fix for CVE-2026-50280?

Yes. craftcms/cms (Packagist): upgrade to 5.9.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-50280 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-50280?

Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50280: Craft CMS authorization bypass in EntriesController move-to-section

Q: Is there a fix for CVE-2026-50280?

Yes. craftcms/cms (Packagist): upgrade to 5.9.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-50280 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-50280?

Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-50280 · Severity: medium · CVSS 4 · Published 2026-07-02

Craft CMS, a popular content management system, contains a flaw that allows users with limited permissions to move content into restricted areas. An authenticated user who has permission to view a section but not edit it can bypass security checks to relocate entries into that protected section. This could allow unauthorized staff to interfere with editorial workflows, bypass approval processes, or modify content ownership in sensitive areas of the website.

Technologies: craftcms/cms (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-50280 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-50280 being exploited in the wild.
How severe is CVE-2026-50280?: Medium severity, with a CVSS score of 4, published 2 July 2026.
Which products and versions are affected?: craftcms/cms (Packagist) >= 5.0.0-RC1, < 5.9.21, ECOSYSTEM:introduced=5.0.0-RC1,fixed=5.9.21.
Is there a fix for CVE-2026-50280?: Yes. craftcms/cms (Packagist): upgrade to 5.9.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50280 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-50280?: Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

craftcms/cms (Packagist): upgrade to 5.9.21 or later
```
composer require craftcms/cms:^5.9.21
```

Technical details

An authorization bypass exists in the `EntriesController::actionMoveToSection()` endpoint of Craft CMS. The root cause is an insufficient permission check: the controller verifies if a user has `viewEntries` permission for the destination section but fails to verify the required `saveEntries` permission. An attacker authenticated to the control panel can exploit this by sending a request to move an entry they already control into a destination section where they only have read access. This allows the attacker to relocate content into unauthorized sections, bypassing the intended section-level authorization model. The issue is fixed in version 5.9.21.

Affected products

Pixel & Tonic Craft CMS >= 5.0.0-RC1, < 5.9.21

Identifiers

CVE-2026-50280
GHSA-43cq-c2gq-pfpw

Timeline

2026-05-29: disclosed
2026-07-02: advisory
2026-07-02: patched: Fixed in version 5.9.21

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.