CVE-2026-72785 in Craft CMS
Summary
by MITRE • 08/11/2026
Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission (without saveCategories) for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via the structures/move-element action. The structureEditable flag is computed from the view permission rather than the save permission, and the StructuresController authorizes the mutating action on that read-time session grant without a save re-check. Because a category's URI is derived from its position in the structure, moving a category changes its URL and those of its descendants and can corrupt navigation menus built from the category taxonomy. The issue is fixed in 5.10.6.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability exists within Craft CMS versions 5.0.0-RC1 through 5.10.5 where an authorization flaw allows users with limited permissions to perform unauthorized structural modifications. The core issue stems from improper privilege validation during category structure manipulation operations, specifically affecting users who possess only the viewCategories permission but lack the saveCategories permission for a given category group. The vulnerability manifests when users attempt to reorder or re-parent categories through the structures/move-element action, which should require save permissions but instead operates based on view-time authorization checks.
The technical flaw resides in how Craft CMS computes the structureEditable flag, which incorrectly derives its value from view permissions rather than save permissions. This misconfiguration creates a security boundary violation where read-only access translates to write-like capabilities during structural operations. The StructuresController fails to perform a secondary permission verification before executing mutating actions, effectively bypassing the intended authorization controls. This pattern aligns with CWE-693 Protection Mechanism Failure, where a protection mechanism is not properly enforced due to incorrect implementation or configuration.
The operational impact of this vulnerability extends beyond simple unauthorized modifications, as it fundamentally compromises content integrity and site navigation. When categories are moved within the structure, their URI paths change dynamically since URLs are generated based on hierarchical position. This cascading effect alters not only the moved category's URL but also affects all descendant categories in the taxonomy tree, potentially breaking internal links and navigation menus that depend on stable category URIs. The vulnerability effectively allows attackers to perform a form of content manipulation that can disrupt site functionality and user experience.
The security implications of this flaw demonstrate a critical misalignment between permission levels and operational capabilities, creating a scenario where users with minimal access can significantly alter site structure and content accessibility. This represents a privilege escalation vulnerability that could be exploited by malicious actors or compromised users with view-only permissions. The fix implemented in version 5.10.6 addresses the root cause by ensuring proper authorization checks are performed before allowing structural modifications, aligning the structureEditable flag computation with appropriate save-level permissions.
Organizations running affected Craft CMS versions should prioritize immediate patching to prevent potential exploitation of this vulnerability. The remediation ensures that structural operations require the appropriate save permissions rather than relying on view-time authorization, thereby maintaining proper access controls and preventing unauthorized content reorganization. This vulnerability highlights the importance of proper permission validation in content management systems where structural changes can have cascading effects on site functionality and user navigation patterns.