CVE-2026-50280 Details
Description
Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 and above prior to 5.9.21, the EntriesController::actionMoveToSection() endpoint gates the destination section only by viewEntries:$section->uid rather than requiring saveEntries permission (the source entry is separately checked via Entry::canMove()). As a result, a low-privileged authenticated control-panel user who can move an entry out of its current section can call moveEntryToSection() to rewrite the entry's sectionId and save it into a section where they have read access but no write access. This breaks the section-level authorization model, letting a user with limited permissions inject content into a protected section and interfere with editorial boundaries, approval workflows, and section-specific business logic. This issue has been fixed in version 5.9.21.
A permission escalation vulnerability has been identified in Craft CMS versions 5.0.0-RC1 and above, prior to 5.9.21. The issue resides in the EntriesController's actionMoveToSection method, where the destination section is only validated for view permissions. This oversight allows low-privileged authenticated control-panel users to move entries into sections where they have read access but lack write permissions. Consequently, this vulnerability disrupts the section-level authorization model, enabling users to inject content into protected areas and disrupt editorial workflows and business logic.
Users can update to Craft CMS version 5.9.21 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 2, 2026CISA-ADP
Assessed Jul 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/craftcms/cms/commit/0a6b916f6367b0162b2eaf2366add67b45fa98ea | [email protected] | Source CodeVendor |
| https://github.com/craftcms/cms/security/advisories/GHSA-43cq-c2gq-pfpw | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Craft CMS | >= 5.0.0-RC1, <= 5.9.21 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 2, 2026 | CVE Modified | CISA-ADP |
| Jul 2, 2026 | New CVE Received | [email protected] |