CVE-2026-28782: Craft CMS Auth Bypass Vulnerability

CVE-2026-28782 Overview

CVE-2026-28782 is an Insecure Direct Object Reference (IDOR) vulnerability in Craft CMS, a popular content management system. The vulnerability exists in the "Duplicate" entry action, which fails to properly verify whether a user has permission to perform this action on specific target elements. Even when users are restricted to "View Entries" permission—where the "Duplicate" action is hidden from the UI—attackers can bypass this restriction by sending direct HTTP requests to the server.

More critically, this vulnerability allows unauthorized duplication of other users' entries by specifying arbitrary Entry IDs. Since Entry IDs in Craft CMS are incremental integers, an attacker can trivially enumerate and brute-force these identifiers to duplicate and access restricted content across the entire system.

Critical Impact

Authenticated users with minimal permissions can bypass authorization controls to duplicate and access any entry in the CMS, including content belonging to other users, potentially exposing sensitive information and proprietary data.

Affected Products

• Craft CMS versions prior to 5.9.0-beta.1 (version 5.x branch)
• Craft CMS versions prior to 4.17.0-beta.1 (version 4.x branch)
• All Craft CMS 4.0.0 and 5.0.0 release candidates

Discovery Timeline

• 2026-03-04 - CVE-2026-28782 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-28782

Vulnerability Analysis

This vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), a form of Insecure Direct Object Reference (IDOR). The core issue stems from the entry duplication controller failing to validate that the requesting user has appropriate permissions for the specific entry being duplicated.

In Craft CMS, the permission model is designed to restrict certain actions based on user roles. However, the "Duplicate" functionality only performs client-side UI restrictions (hiding the button) rather than implementing proper server-side authorization checks. This creates a classic example of relying on security through obscurity rather than enforcing access control at the application logic layer.

The attack surface is amplified by the use of predictable, sequential Entry IDs. An attacker who identifies the pattern can systematically enumerate all entries in the system, testing each ID for successful duplication. This transforms a limited access control bypass into a potential full content exfiltration vulnerability.

Root Cause

The root cause is insufficient authorization validation in the server-side entry duplication handler. When processing a duplicate request, the application checks if the user has general "View Entries" permission but does not verify:

1. Whether the user has explicit "Duplicate" permission for entries
2. Whether the user is authorized to access the specific entry being targeted
3. Whether the entry belongs to the requesting user or is within their permitted scope

The authorization logic relied on UI-level restrictions rather than enforcing access control at the API/controller level, violating the principle of defense in depth.

Attack Vector

The attack is network-based and requires low-privilege authenticated access. An attacker with only "View Entries" permission can exploit this vulnerability through the following approach:

The attacker first authenticates to the Craft CMS admin panel with a low-privilege account. Despite the "Duplicate" action being hidden from the UI, the attacker crafts a direct HTTP POST request to the entry duplication endpoint, specifying a target Entry ID in the request body. Since Entry IDs are sequential integers starting from 1, the attacker can iterate through potential IDs (1, 2, 3, etc.) to discover and duplicate entries they should not have access to.

For technical implementation details and the specific fix applied, refer to the GitHub Security Advisory and the commit that addresses this vulnerability.

Detection Methods for CVE-2026-28782

Indicators of Compromise

• Unusual volume of entry duplication requests from a single user session
• Duplication actions performed by users with only "View Entries" permissions
• Sequential or patterned Entry ID access attempts in duplication request logs
• Newly created duplicate entries attributed to low-privilege users

Detection Strategies

• Monitor Craft CMS access logs for POST requests to entry duplication endpoints from users lacking duplication permissions
• Implement anomaly detection for rapid sequential requests targeting incrementing Entry IDs
• Review audit logs for unauthorized content duplication events, especially from restricted user accounts
• Configure web application firewall (WAF) rules to alert on enumeration patterns in request parameters

Monitoring Recommendations

• Enable detailed audit logging in Craft CMS to capture all entry modification events
• Set up alerts for bulk entry duplication operations outside of normal administrative workflows
• Monitor for failed authorization events that may indicate reconnaissance activity
• Review user permission assignments regularly to identify overly permissive configurations

How to Mitigate CVE-2026-28782

Immediate Actions Required

• Upgrade Craft CMS to version 5.9.0-beta.1 or later for 5.x installations
• Upgrade Craft CMS to version 4.17.0-beta.1 or later for 4.x installations
• Audit user accounts to identify and review permissions for all users with "View Entries" access
• Review CMS logs for evidence of exploitation attempts or unauthorized entry duplication

Patch Information

Craftcms has released security patches that address this authorization bypass vulnerability. The fix implements proper server-side permission validation for the entry duplication action, ensuring that users cannot duplicate entries without explicit authorization.

The patched versions are 5.9.0-beta.1 and 4.17.0-beta.1. Organizations should update to these versions or later stable releases as they become available. The security fix can be reviewed in the GitHub commit.

Workarounds

• Restrict network access to the Craft CMS admin panel to trusted IP addresses only
• Implement additional authentication layers (MFA) for all CMS user accounts
• Review and minimize user permissions, removing "View Entries" access where not strictly required
• Deploy a web application firewall to detect and block enumeration attack patterns

# Restrict admin panel access in nginx configuration
location /admin {
    allow 10.0.0.0/8;      # Internal network only
    allow 192.168.1.0/24;  # Trusted admin subnet
    deny all;
    
    # Additional rate limiting for entry actions
    limit_req zone=cms_admin burst=10 nodelay;
}