Executive brief
Craft CMS is a content management platform that allows teams to collaboratively create and manage website content. A vulnerability in the entry-editing feature allows users with limited permissions (e.g., permission to edit Section A only) to move or publish entries into sections they should not have access to, such as a homepage or sensitive content area. This could result in unauthorized content being published to the live site, compromising content integrity and potentially affecting all site visitors.
Technical details
The vulnerability is a broken access control flaw (CWE-862) in the element-indexes/save-elements endpoint. The endpoint performs an authorization check via canSave() before applying client-supplied attributes, but this check is based on the entry's current sectionId. An attacker can overwrite the sectionId attribute after passing the initial authorization check, then the entry is saved without a second authorization check on the destination section. The attack requires a valid control panel account with limited section permissions (e.g., author or editor role) and involves no user interaction. By duplicating their own entry in an authorized section and then moving the copy to an unauthorized section via the vulnerable endpoint, an attacker can effectively publish arbitrary entries to any section. The vulnerability was patched in version 5.10.11; affected versions are 5.0.0-RC1 through 5.10.10.
Affected products
- Craft CMS 5.0.0-RC1 through 5.10.10
Timeline
- 2026-08-18: disclosed: GitHub Security Advisory GHSA-ccpq-mw3m-wwg2 published
- 2026-09-02: patched: CVE-2026-84792 published; patched in version 5.10.11