Craft CMS up to 5.9.20 Request Parameter beforeAction _attributes dynamically-determined object attributes

Summaryinfo

A vulnerability classified as critical was found in Craft CMS up to 5.9.20. Affected by this issue is the function ElementsController::beforeAction of the component Request Parameter Handler. Executing a manipulation of the argument _attributes can lead to dynamically-determined object attributes. This vulnerability is registered as CVE-2026-50281. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in Craft CMS up to 5.9.20 and classified as critical. This vulnerability affects the function ElementsController::beforeAction of the component Request Parameter Handler. The manipulation of the argument _attributes with an unknown input leads to a dynamically-determined object attributes vulnerability. The CWE definition for the vulnerability is CWE-915. The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified. The impact remains unknown. CVE summarizes:

Craft CMS is a content management system (CMS). Versions 5.7.0 and above, prior to 5.9.21 contain a mass-assignment flaw in the bulk-duplicate element action. An attacker who is only able to duplicate their own entires can submit an arbitrary id through the newAttributes request parameter. The duplication routine overrides its own id = null reset with that value and writes the attacker's attributes into the victim's existing entry row. ElementsController::beforeAction() pulls the request body into $this->_attributes and rejects requests that ship an id or canonicalId key at the top level, actionBulkDuplicate(), reads a separate newAttributes array and passes it straight through to the service layer. Elements::duplicateElement() clones the source element, sets id to null, and then hands the attacker's array to Craft::configure(), which overwrites the reset id with any numeric value inside $newAttributes. PHP Yii's saveElement() then performs an UPDATE against the row with that primary key instead of an INSERT. The attackers's title, slug, authorId, postDate, and UID land on the victim's entry. safeAttributes() on Entry includes id because the base element model exposes it, so the Collection::only() filter does not strip it. This issue has been fixed in version 5.9.21.

The advisory is available at github.com. This vulnerability was named CVE-2026-50281 since 06/04/2026. The exploitation appears to be easy. The attack can be initiated remotely. Technical details are known, but there is no available exploit.

Upgrading to version 5.9.21 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Content Management System

Vendor

• Craft

Name

• CMS

Version

• 5.9.0
• 5.9.1
• 5.9.2
• 5.9.3
• 5.9.4
• 5.9.5
• 5.9.6
• 5.9.7
• 5.9.8
• 5.9.9
• 5.9.10
• 5.9.11
• 5.9.12
• 5.9.13
• 5.9.14
• 5.9.15
• 5.9.16
• 5.9.17
• 5.9.18
• 5.9.19
• 5.9.20

License

• free

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion