CVE-2026-50281: Craft CMS mass assignment in bulk-duplicate element action

Executive brief

Craft CMS, a popular content management system, contains a flaw that allows users with limited permissions to overwrite content they do not own. By exploiting a weakness in the 'bulk duplicate' feature, an authorized author could modify or replace entries, categories, or user data belonging to others. This could lead to significant data corruption and loss of content integrity across the entire website.

Technical details

A mass assignment vulnerability (CWE-915) exists in Craft CMS's ElementsController. While the application attempts to block 'id' and 'canonicalId' at the top level of request parameters, it fails to inspect the 'newAttributes' array used during bulk duplication. An attacker with permission to duplicate their own entries can inject a target 'id' into this array. The duplication routine clones the source element, resets its ID to null, but then uses Craft::configure() to merge the attacker-supplied attributes, which restores the target ID. Consequently, the underlying Yii framework performs a database UPDATE instead of an INSERT, overwriting the target record. This is patched in version 5.9.21.

Affected products

• Pixel & Tonic Craft CMS >= 5.7.0, < 5.9.21

Timeline

• 2026-05-29: patched: Fix released in version 5.9.21
• 2026-07-02: advisory: GitHub Advisory published

References

• https://api.github.com/users/adrgs
• https://github.com/adrgs
• https://api.github.com/users/adrgs/gists%7B/gist_id%7D
• https://api.github.com/users/adrgs/repos
• https://avatars.githubusercontent.com/u/11564377?v=4
• https://api.github.com/users/adrgs/events%7B/privacy%7D