CVE-2026-50280: Craft CMS Privilege Escalation Vulnerability

CVE-2026-50280 Overview

Craft CMS is a content management system (CMS) affected by a broken access control vulnerability in the EntriesController::actionMoveToSection() endpoint. Versions 5.0.0-RC1 through versions prior to 5.9.21 gate the destination section using only the viewEntries:$section->uid permission instead of requiring saveEntries. A low-privileged authenticated control-panel user can call moveEntryToSection() to rewrite an entry's sectionId and save it into a section where they hold read-only access. The flaw is tracked as [CWE-284: Improper Access Control] and was fixed in version 5.9.21.

Critical Impact
Authenticated users with limited permissions can inject content into protected sections, bypassing section-level authorization and interfering with editorial workflows.

Affected Products

Craft CMS versions 5.0.0-RC1 and above
Craft CMS versions prior to 5.9.21
Craft CMS EntriesController component

Discovery Timeline

2026-07-02 - CVE-2026-50280 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-50280

Vulnerability Analysis

The vulnerability resides in the EntriesController::actionMoveToSection() endpoint of Craft CMS. The controller validates only that the requesting user holds the viewEntries permission on the destination section, referenced by $section->uid. Write authorization via saveEntries is never enforced on the target section. The source entry permission is separately verified through Entry::canMove(), which creates an asymmetric permission check between source and destination.

An authenticated control-panel user with move rights on a source entry can invoke moveEntryToSection() and rewrite the entry's sectionId. The entry is then persisted into a section where the user can view content but cannot legitimately create or edit entries. This breaks the section-level authorization model that Craft CMS uses to separate editorial responsibilities and approval workflows.

Root Cause

The root cause is an incomplete authorization check in the move-to-section workflow. The controller trusts read-level permissions as a proxy for write-level intent. Because moving an entry into a section is functionally equivalent to creating or saving content in that section, the missing saveEntries check allows privilege boundaries to collapse.

Attack Vector

Exploitation requires network access to the Craft CMS control panel and a valid low-privileged authenticated session. An attacker crafts a request to the move endpoint targeting a destination section where they hold only viewEntries. The server accepts the request, rewrites sectionId, and saves the entry into the protected section.

php

// Patch excerpt from src/controllers/EntriesController.php
// Fix for GHSA-43cq-c2gq-pfpw
                     return false;
                 }

-
                 $sectionEntryTypes = array_map(fn($et) => $et->id, $section->entryTypes);

                 return !empty(array_intersect($entryTypes, $sectionEntryTypes));

Source: GitHub Commit 0a6b916

Detection Methods for CVE-2026-50280

Indicators of Compromise

Unexpected entries appearing in sections owned by other editorial teams or protected workflows
Audit log entries showing moveEntryToSection actions initiated by users who lack saveEntries on the destination section
Entries whose sectionId was rewritten by users without corresponding write permissions on the new section

Detection Strategies

Review Craft CMS activity logs for actionMoveToSection calls and cross-reference the acting user's permissions against the destination section
Query the entries table for records whose most recent modifying user does not hold saveEntries on the current sectionId
Compare pre- and post-request section assignments for entries modified by non-editorial roles

Monitoring Recommendations

Enable verbose control-panel action logging and forward logs to a centralized SIEM for correlation
Alert on any move-to-section operation performed by accounts categorized as read-only or contributor-level
Track anomalous spikes in entry movement between sections belonging to different editorial groups

How to Mitigate CVE-2026-50280

Immediate Actions Required

Upgrade Craft CMS to version 5.9.21 or later without delay
Audit all control-panel user roles and remove unnecessary move or view permissions on protected sections
Review recently moved entries and revert any unauthorized section reassignments

Patch Information

The issue is resolved in Craft CMS version 5.9.21. The fix adds the required saveEntries permission check on the destination section within EntriesController::actionMoveToSection(). Details are available in the GitHub Security Advisory GHSA-43cq-c2gq-pfpw and the upstream commit 0a6b916.

Workarounds

Restrict access to the control panel using network-level controls until the patch is applied
Temporarily remove move-entry permissions from low-privileged roles to prevent invocation of the affected endpoint
Isolate protected sections by moving sensitive content to sections accessible only by trusted editorial accounts

bash

# Verify installed Craft CMS version and upgrade via Composer
php craft --version
composer require craftcms/cms:^5.9.21 -w
php craft up