CVE-2026-92589 Overview
CVE-2026-92589 is a broken access control vulnerability [CWE-862] in Craft CMS versions 5.0.0 through 5.10.12. The flaw resides in the actions/nested-elements/reorder endpoint, which trusts a session authorization flag without rechecking the caller's save permission on the owner element. An authenticated control panel user with viewEntries and viewPeerEntries permissions, but without savePeerEntries, can rewrite the sort order of Matrix blocks or Address fields on entries owned by other authors. Craft CMS 5.10.13 addresses the issue.
Critical Impact
Authenticated view-only users can modify the ordering of nested Matrix and Address content on entries they are explicitly denied save access to, undermining editorial integrity.
Affected Products
- Craft CMS 5.0.0 through 5.10.12
- Craft CMS control panel actions/nested-elements/reorder endpoint
- Matrix and Address field types on entries owned by peer authors
Discovery Timeline
- 2026-09-16 - CVE-2026-92589 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-92589
Vulnerability Analysis
Craft CMS is a content management system whose control panel enforces per-user permissions such as viewEntries, viewPeerEntries, saveEntries, and savePeerEntries. When a user with view-only access opens another author's entry in read-only mode, Craft grants the session a manageNestedElements::<ownerId>::field:<handle> authorization flag for the entry's Matrix and Address fields. This flag exists to support in-page rendering of nested elements even in read-only views.
The actions/nested-elements/reorder endpoint consumes this flag as the sole authorization check. Unlike the corresponding delete endpoint, it never re-evaluates whether the current user actually holds save permission on the owner element. That divergence between two related endpoints is the root of the vulnerability.
A successful attacker cannot create, delete, or edit the underlying content of nested elements. The impact is limited to reordering, which maps to a low integrity outcome with no confidentiality or availability impact.
Root Cause
The root cause is a missing authorization check [CWE-862] in the reorder handler. The endpoint accepts the pre-issued manageNestedElements session flag as proof of intent, without confirming that the caller retains save permission for the owner element at request time. The delete handler performs this additional check; the reorder handler does not.
Attack Vector
Exploitation requires an authenticated control panel session with viewEntries and viewPeerEntries. The attacker loads a target entry belonging to another author in read-only mode, then reads the ownerElementType, ownerId, ownerSiteId, attribute, elementIds, and offset values from the page source. The attacker submits a crafted POST request to actions/nested-elements/reorder with these parameters and a chosen new order. Craft applies the new ordering to Matrix blocks or Address entries on the peer-owned content.
No verified public exploit code is available. See the GitHub Security Advisory GHSA-6fp2-8j9w-7mj8 and the VulnCheck Advisory for further technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-92589
Indicators of Compromise
- POST requests to actions/nested-elements/reorder originating from user sessions that lack savePeerEntries permission on the referenced ownerId.
- Repeated reorder requests where the authenticated user is not the owner of the referenced entry.
- Unexplained changes to the sort order of Matrix blocks or Address fields with no corresponding entry-save event in the audit log.
Detection Strategies
- Correlate web access logs for actions/nested-elements/reorder calls against Craft's user permission model to flag users without save rights on the target owner.
- Compare Matrix and Address element ordering snapshots over time and surface changes not attributable to a save action by an authorized editor.
- Alert on control panel sessions that generate reorder traffic against ownerId values belonging to peer authors.
Monitoring Recommendations
- Enable verbose logging of Craft CMS control panel action endpoints, in particular actions/nested-elements/*.
- Forward Craft CMS web server logs and application audit events into a centralized log platform for correlation with user identity data.
- Track user permission assignments so that view-only accounts are inventoried and monitored more closely.
How to Mitigate CVE-2026-92589
Immediate Actions Required
- Upgrade Craft CMS to version 5.10.13 or later, which enforces the save permission check on the reorder endpoint.
- Audit control panel user permissions and remove viewPeerEntries from accounts that do not require it.
- Review recent modifications to nested Matrix and Address fields on peer-owned entries and restore ordering where required.
Patch Information
Craft CMS 5.10.13 fixes CVE-2026-92589 by requiring the reorder handler to recheck the caller's save permission on the owner element rather than trusting the pre-issued manageNestedElements session flag. Details are published in the GitHub Security Advisory GHSA-6fp2-8j9w-7mj8.
Workarounds
- Restrict access to the actions/nested-elements/reorder endpoint at the web server or reverse proxy layer until the upgrade is applied.
- Reduce the number of accounts granted viewPeerEntries to the minimum required for editorial workflows.
- Increase monitoring of reorder actions and revert unauthorized changes when detected.
# Upgrade Craft CMS via Composer to the patched release
composer require craftcms/cms:^5.10.13 --update-with-dependencies
php craft up
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
