CVE-2026-50279: Craft CMS Auth Bypass Vulnerability

CVE-2026-50279 Overview

Craft CMS contains an authorization flaw in the EntriesController::actionSaveEntry() method that permits authorship spoofing. The controller performs entry-edit permission checks before request-controlled author changes are applied to the entry model. Because authorization is not re-evaluated after the author list mutation, a low-privileged user who is one of the existing authors can reassign the entry to a different user. This bypass sidesteps the dedicated peer-author-change permission that would otherwise block the operation. The flaw affects Craft CMS versions 5.0.0-RC1 and later, prior to 5.9.21. It is tracked as [CWE-285] Improper Authorization.

Critical Impact
A low-privileged authenticated user can reassign entry authorship to arbitrary users, undermining content attribution and access boundaries within the CMS.

Affected Products

Craft CMS 5.0.0-RC1 through 5.9.20
Craft CMS installations exposing entry editing to multi-author workflows
Craft CMS deployments relying on peer-author-change permission enforcement

Discovery Timeline

2026-07-02 - CVE-2026-50279 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-50279

Vulnerability Analysis

The vulnerability resides in the EntriesController::actionSaveEntry() action in Craft CMS. The controller calls enforceEditEntryPermissions() against the entry state prior to populating the model with attacker-controlled POST data. When _populateEntryModel($entry) subsequently applies the request payload, it accepts authors and author parameters supplied by the requester. The author mutation code path permits the change whenever the current user matches one of the previous authors of the entry.

Because the controller never re-runs authorization after the author list is mutated, the dedicated peer-author-change permission is never consulted. An authenticated user who is listed as an author on an entry can therefore reassign that entry to any other user in the system. This breaks the trust boundary between co-authors and the elevated permission designed to gate cross-author reassignments.

Root Cause

The root cause is an ordering defect: authorization is performed against the pre-mutation entry, then the author fields are overwritten with untrusted input. No secondary check compares the resulting author set against the requesting user's peer-author-change permission. This is a classic broken access control pattern where state-changing input invalidates the earlier authorization decision.

Attack Vector

An attacker authenticated as a low-privileged author submits a crafted POST request to the entry save endpoint. The request includes modified authors or author parameters targeting a different user account. Because the attacker is currently one of the entry's authors, the mutation is accepted and persisted without the peer-author-change permission being enforced.

php

         // Populate the entry with post data
         $this->_populateEntryModel($entry);
 
+        $this->enforceEditEntryPermissions($entry, $duplicate);
+
         if ($forceDisabled) {
             $entry->enabled = false;
         }

Source: Craft CMS Commit 9cc493b. The patch re-invokes enforceEditEntryPermissions() after the model is populated with request data, ensuring authorization reflects the mutated author state.

Detection Methods for CVE-2026-50279

Indicators of Compromise

Entry revision history showing author reassignments performed by users lacking the peer-author-change permission.
POST requests to the entry save endpoint containing authors[] or author parameters that differ from the entry's existing author set.
Sudden changes to authorId fields in the entries table without a corresponding admin-user session.

Detection Strategies

Compare Craft CMS entry revision logs against user role assignments to identify reassignments that should have required elevated permissions.
Instrument the web tier to log request bodies for /admin/entries/save-entry and flag payloads that alter author fields.
Query the database periodically for entries whose author changed while the modifying user lacked peerAuthorChange on the section.

Monitoring Recommendations

Enable verbose audit logging for entry mutation events and forward logs to a centralized SIEM.
Alert on anomalies in the ratio of author-change operations per user, especially for accounts that have never previously modified authorship.
Track authentication sessions that issue rapid successive save-entry requests referencing multiple distinct authors.

How to Mitigate CVE-2026-50279

Immediate Actions Required

Upgrade Craft CMS to version 5.9.21 or later without delay.
Audit recent entry revisions for unauthorized author reassignments and restore correct authorship where necessary.
Review the peer-author-change permission assignments across all user groups and remove where not required.
Rotate credentials for any low-privileged accounts suspected of exploiting the flaw.

Patch Information

The issue is fixed in Craft CMS 5.9.21. The corrective commit re-invokes enforceEditEntryPermissions($entry, $duplicate) after _populateEntryModel($entry) applies request data, so the authorization decision reflects the mutated author list. See the GitHub Security Advisory GHSA-qq2c-2q8j-jh27 and the upstream commit for the authoritative fix.

Workarounds

Restrict entry editing permissions to trusted users until the patched version is deployed.
Temporarily disable multi-author sections or reduce the number of assigned authors per entry to shrink the attack surface.
Front the Craft CMS admin with a web application firewall rule that rejects save-entry requests attempting to modify authors or author fields for non-privileged sessions.

bash

# Upgrade Craft CMS via Composer to the patched release
composer require craftcms/cms:^5.9.21 --update-with-dependencies
php craft up