# CVE-2026-50280: Craft CMS authorization bypass in EntriesController move-to-section

Source: https://junglewise.ai/threats/cve-2026-50280-craft-cms-authorization-bypass-in-entriescontroller-move-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-02. Updated: 2026-07-02  
License: CC BY 4.0 with a link back

CVE-2026-50280 · Severity: medium · CVSS 4 · Published 2026-07-02

Craft CMS, a popular content management system, contains a flaw that allows users with limited permissions to move content into restricted areas. An authenticated user who has permission to view a section but not edit it can bypass security checks to relocate entries into that protected section. This could allow unauthorized staff to interfere with editorial workflows, bypass approval processes, or modify content ownership in sensitive areas of the website.

Technologies: [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-50280 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-50280 being exploited in the wild.

**How severe is CVE-2026-50280?** Medium severity, with a CVSS score of 4, published 2 July 2026.

**Which products and versions are affected?** craftcms/cms (Packagist) >= 5.0.0-RC1, < 5.9.21, ECOSYSTEM:introduced=5.0.0-RC1,fixed=5.9.21.

**Is there a fix for CVE-2026-50280?** Yes. craftcms/cms (Packagist): upgrade to 5.9.21 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-50280 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-50280?** Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- craftcms/cms (Packagist): upgrade to 5.9.21 or later

  ```sh
  composer require craftcms/cms:^5.9.21
  ```


## Technical details

An authorization bypass exists in the `EntriesController::actionMoveToSection()` endpoint of Craft CMS. The root cause is an insufficient permission check: the controller verifies if a user has `viewEntries` permission for the destination section but fails to verify the required `saveEntries` permission. An attacker authenticated to the control panel can exploit this by sending a request to move an entry they already control into a destination section where they only have read access. This allows the attacker to relocate content into unauthorized sections, bypassing the intended section-level authorization model. The issue is fixed in version 5.9.21.

## Affected products

- Pixel & Tonic Craft CMS >= 5.0.0-RC1, < 5.9.21

## Identifiers

- CVE-2026-50280
- GHSA-43cq-c2gq-pfpw

## Timeline

- 2026-05-29: disclosed
- 2026-07-02: advisory
- 2026-07-02: patched: Fixed in version 5.9.21

## References

- [https://api.github.com/users/larlarua](https://api.github.com/users/larlarua)
- [https://github.com/larlarua](https://github.com/larlarua)
- [https://api.github.com/users/larlarua/gists%7B/gist_id%7D](https://api.github.com/users/larlarua/gists%7B/gist_id%7D)
- [https://api.github.com/users/larlarua/repos](https://api.github.com/users/larlarua/repos)
- [https://avatars.githubusercontent.com/u/90000267?v=4](https://avatars.githubusercontent.com/u/90000267?v=4)
- [https://api.github.com/users/larlarua/events%7B/privacy%7D](https://api.github.com/users/larlarua/events%7B/privacy%7D)

## Related threats

- [Craft CMS: Stored XSS in the control panel via unescaped draft name](https://junglewise.ai/threats/cve-2026-72787-craft-cms-stored-xss-in-the-control-panel-via-unescaped-draft)
- [Craft CMS: Arbitrary user password reset leading to administrator account takeover](https://junglewise.ai/threats/cve-2026-72786-craft-cms-arbitrary-user-password-reset-leading-to-administrator)
- [Craft CMS authorization bypass in category structure modification](https://junglewise.ai/threats/craft-cms-authorization-bypass-in-category-structure-modification-1555f980)
- [Craft CMS authenticated RCE through Twig sandbox escape](https://junglewise.ai/threats/craft-cms-authenticated-rce-through-twig-sandbox-escape-32ee5ec1)
- [Craft CMS path traversal in ensurePathIsContained](https://junglewise.ai/threats/craft-cms-path-traversal-in-ensurepathiscontained-4adc3058)