CVE-2026-84792 in Craft CMS
Summary
by MITRE • 09/02/2026
Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized sections by overwriting the sectionId attribute after initial authorization checks, bypassing the destination section permission validation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/02/2026
Craft CMS versions prior to 5.10.11 are affected by a critical broken access control vulnerability located within the element-indexes/save-elements endpoint of the content management system's administrative interface. This flaw stems from an insufficient authorization check that fails to validate user permissions against the target destination for data modifications. Specifically, when a logged-in Control Panel user initiates an action to move or publish entries, the application performs an initial security verification based on the source location or general editing rights but neglects to re-evaluate access controls after the request parameters are processed. This architectural oversight allows attackers who possess limited permissions within specific sections of the CMS to manipulate the sectionId attribute in their HTTP requests. By altering this identifier, they can effectively bypass the intended permission boundaries and relocate entries into sections where they have no edit or publish privileges.
The technical mechanism behind this vulnerability relies on the manipulation of client-side supplied data that is directly mapped to server-side database operations without adequate server-side validation. In a secure implementation, any change in ownership or location of content objects must trigger a comprehensive permission check against the new target context. However, in vulnerable versions of Craft CMS, the system trusts the sectionId provided by the user after the initial authorization step has already passed for their current role and source permissions. This logic error enables unauthorized users to perform actions that should be restricted to administrators or editors with broader scope rights. The vulnerability is particularly dangerous because it does not require authentication bypass or privilege escalation in the traditional sense; rather, it exploits a gap in object-level access control where the user's identity is valid but their specific permissions for the target resource are ignored during the write operation.
From an operational perspective, this flaw poses significant risks to data integrity and confidentiality within organizations using Craft CMS as their primary content management platform. Attackers can use this vulnerability to publish sensitive or unapproved content in public-facing sections without authorization, potentially leading to reputational damage, regulatory non-compliance, or the spread of malicious information. Furthermore, by moving entries into unauthorized sections, attackers may disrupt editorial workflows, cause confusion among legitimate editors, and undermine the governance model established for content management. The ability to publish entries also means that an attacker could inject phishing links, defacement text, or other harmful payloads directly into live website content, affecting end-users who visit those pages. This represents a severe breach of trust in the administrative interface's security controls.
This vulnerability aligns with CWE-284 Improper Access Control and is categorized under MITRE ATT&CK technique T1078 Valid Accounts when combined with initial authentication, specifically relating to lateral movement or persistence within the application layer by abusing legitimate credentials for unauthorized actions. To mitigate this risk, organizations must immediately upgrade Craft CMS to version 5.10.11 or later where these permission checks have been corrected to validate access rights against both source and destination contexts during save operations. Until an update can be applied, administrators should consider implementing web application firewall rules that monitor for anomalous changes in sectionId parameters on the element-indexes/save-elements endpoint and restrict write permissions to only those users who absolutely require them. Regular security audits of custom plugins or modules are also recommended to ensure no similar logic flaws exist elsewhere in the codebase.