CVE-2026-84792 Overview
Craft CMS versions before 5.10.11 contain a broken access control vulnerability [CWE-862] in the element-indexes/save-elements endpoint. Authenticated control panel users with limited section permissions can move or publish entries into sections they are not authorized to edit. The flaw stems from the endpoint performing permission checks on the source section but failing to re-validate authorization after the sectionId attribute is overwritten. This allows attackers to relocate entries into unauthorized destination sections, bypassing intended access boundaries within the content management workflow.
Critical Impact
Authenticated low-privilege users can move or publish entries into sections outside their permission scope, undermining content segregation and editorial workflows.
Affected Products
- Craft CMS versions prior to 5.10.11
- Deployments exposing the control panel to untrusted or low-trust users
- Multi-section Craft CMS installations relying on section-level permissions for content isolation
Discovery Timeline
- 2026-09-02 - CVE-2026-84792 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84792
Vulnerability Analysis
The vulnerability resides in the element-indexes/save-elements endpoint of the Craft CMS control panel. The endpoint accepts a sectionId attribute that determines the destination section for entries being saved. Craft CMS performs authorization checks against the initial context of the request, but the sectionId value can be overwritten after those checks complete. This creates a gap between authorization and enforcement, allowing entries to be committed to a destination the acting user cannot access.
The issue is a Missing Authorization weakness. The application authorizes an action against one resource identifier and then executes the action against a different resource identifier supplied by the client. Because the destination section permission is never re-validated, section boundaries collapse for any authenticated control panel user with rights to save elements in at least one section.
Root Cause
The root cause is incomplete authorization enforcement in the save-elements workflow. The endpoint trusts the post-authorization state of the request payload rather than re-checking permissions against the final sectionId value used for persistence. This is a classic time-of-check to time-of-use pattern in application-layer access control.
Attack Vector
Exploitation requires an authenticated control panel account with at least limited section permissions. The attacker submits a crafted request to element-indexes/save-elements, overwriting the sectionId attribute so the target destination differs from the section the attacker is entitled to modify. The server accepts the write, moving or publishing the entry into the unauthorized section. No user interaction from a privileged operator is required. Refer to the GitHub Security Advisory GHSA-ccpq-mw3m-wwg2 and the VulnCheck Advisory for Craft CMS for authoritative technical detail.
No verified public exploit code is available at the time of writing. The vulnerability mechanism is described in prose to avoid synthetic proof-of-concept fabrication.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-84792
Indicators of Compromise
- Requests to element-indexes/save-elements in web server or application logs where the acting user lacks edit permissions on the resulting destination section.
- Entries appearing in sections whose audit trail shows a savedBy user without documented permissions to that section.
- Unexpected changes to entry sectionId values in the Craft CMS database that do not correlate with administrator activity.
Detection Strategies
- Correlate control panel access logs against Craft CMS user role assignments to identify writes that cross permission boundaries.
- Baseline normal editorial flows per user and flag deviations where entries move between sections outside a user's assigned scope.
- Alert on unusual volumes of save-elements requests originating from low-privileged accounts.
Monitoring Recommendations
- Enable verbose logging for control panel endpoints, particularly element-indexes/* routes, and forward logs to a centralized analytics platform.
- Monitor Craft CMS entries table changes with database auditing to capture sectionId mutations along with acting user identity.
- Track authentication and session activity for control panel accounts to identify credential reuse or unexpected privilege patterns.
How to Mitigate CVE-2026-84792
Immediate Actions Required
- Upgrade Craft CMS to version 5.10.11 or later on all affected installations.
- Audit recent entry moves and publications for evidence of unauthorized section changes performed by low-privileged users.
- Review and tighten control panel account inventory, removing dormant or unnecessary editor accounts.
Patch Information
Craft CMS addressed the vulnerability in version 5.10.11. The fix ensures that authorization checks are re-applied against the final sectionId used to persist the entry, closing the gap between authorization and execution. Detailed remediation notes are published in the GitHub Security Advisory GHSA-ccpq-mw3m-wwg2.
Workarounds
- Restrict access to the Craft CMS control panel using network-level controls such as IP allowlists or VPN gating until patching is complete.
- Temporarily reduce the number of accounts with any section save permissions to trusted operators only.
- Increase logging and manual review of section content changes as a compensating control during the patch window.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
