CVE-2026-72785: Craft CMS Auth Bypass Vulnerability

CVE-2026-72785 Overview

CVE-2026-72785 is an incorrect authorization vulnerability [CWE-863] affecting Craft CMS versions 5.0.0-RC1 through 5.10.5. A control-panel user granted only the viewCategories permission for a category group can permanently modify that group's category structure. The user can reorder and re-parent categories through the structures/move-element action without holding the saveCategories permission. Because a category's URI is derived from its position in the structure, moving a category rewrites its URL and the URLs of all descendants. Navigation menus built from the category taxonomy can be corrupted as a result. The issue is fixed in Craft CMS 5.10.6.

Critical Impact
A read-only control-panel user can permanently alter category taxonomy, break URLs across a site, and corrupt navigation menus without holding save permissions.

Affected Products

Craft CMS 5.0.0-RC1 through 5.10.5
Craft CMS control panel category groups
Sites relying on category-derived URIs and navigation menus

Discovery Timeline

2026-08-11 - CVE-2026-72785 published to the National Vulnerability Database
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72785

Vulnerability Analysis

The vulnerability resides in how Craft CMS evaluates permissions when authorizing structure mutations on category groups. The structureEditable flag is derived from the view permission rather than the save permission. When a user with only viewCategories opens the control panel, the resulting session grant marks the structure as editable for read purposes. The StructuresController then authorizes the mutating structures/move-element action against that read-time session grant. The controller does not perform a save-time re-check against saveCategories before persisting the reorder or re-parent operation.

Because category URIs are computed from their position in the structure, moving a node rewrites the URI for that category and every descendant. Any navigation menus or site elements that reference categories through the taxonomy can be broken. The change is persistent and affects public site output, not only the control panel view.

Root Cause

The root cause is a mismatch between the permission consulted at session-grant time and the permission required for the mutating action. The application conflates the ability to view a structure with the ability to modify it. The StructuresController trusts the earlier grant instead of re-authorizing the request against saveCategories, which is the correct permission for persistent structural changes.

Attack Vector

The attack requires an authenticated control-panel account with the viewCategories permission for at least one category group. The attacker issues a request to the structures/move-element action targeting a category node in the affected group. No user interaction beyond the attacker's own session is required, and no additional privileges are needed. The mutation is written to the structure store and takes effect immediately for both the control panel and the public site.

Refer to the GitHub Security Advisory and the VulnCheck Advisory on Craft CMS for additional technical detail.

Detection Methods for CVE-2026-72785

Indicators of Compromise

Requests to the structures/move-element action originating from control-panel users who lack saveCategories for the target group.
Unexpected changes to category uri, parentId, or structureId fields in the elements and structureelements tables.
Broken links or 404 responses on public URLs previously served by category pages.
Navigation menus rendering incorrect ordering or missing entries after a control-panel session by a viewer-only account.

Detection Strategies

Review Craft CMS web server access logs for POST requests to actions/structures/move-element and correlate the acting user with their assigned permissions.
Audit the Craft changelog and element history for reorder or re-parent events on category groups within the affected version range.
Compare current category URIs against a known-good snapshot to identify unauthorized structural changes.

Monitoring Recommendations

Enable and centralize Craft CMS control-panel audit logging, forwarding events to a SIEM for correlation.
Alert on any move-element action performed by a user whose role does not include saveCategories for the target group.
Monitor sitemap and 404 telemetry for sudden spikes affecting URLs derived from category taxonomy.

How to Mitigate CVE-2026-72785

Immediate Actions Required

Upgrade all Craft CMS installations to version 5.10.6 or later.
Review and tighten control-panel role assignments so that viewCategories is granted only to accounts that legitimately need it.
Take a database backup and snapshot current category structures before upgrading so that any unauthorized changes can be reverted.

Patch Information

The vulnerability is fixed in Craft CMS 5.10.6. Details are published in the GitHub Security Advisory GHSA-xxpx-f366-4xpq. Administrators should apply the update through Composer and verify the running version in the control panel after deployment.

Workarounds

Revoke viewCategories from any control-panel users who do not require access until the upgrade to 5.10.6 is complete.
Restrict access to the /admin control-panel path at the web server or WAF layer to trusted networks and administrators.
Block or rate-limit unauthenticated and low-privilege access to actions/structures/move-element at the reverse proxy where feasible.

bash

# Configuration example: upgrade Craft CMS to the patched release
composer require craftcms/cms:^5.10.6 --update-with-dependencies
php craft up
php craft migrate/all