CVE-2026-50280: Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check

Severity: medium (CVSS 6.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-02 · updated 2026-10-25
Weakness: CWE-284

Description

Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 and above prior to 5.9.21, the EntriesController::actionMoveToSection() endpoint gates the destination section only by viewEntries:$section->uid rather than requiring saveEntries permission (the source entry is separately checked via Entry::canMove()). As a result, a low-privileged authenticated control-panel user who can move an entry out of its current section can call moveEntryToSection() to rewrite the entry's sectionId and save it into a section where they have read access but no write access. This breaks the section-level authorization model, letting a user with limited permissions inject content into a protected section and interfere with editorial boundaries, approval workflows, and section-specific business logic. This issue has been fixed in version 5.9.21.

Affected products

craftcms cms: from 5.0.0-RC1, < 5.9.21

References

Get alerted when CVE-2026-50280 or the next vulnerability affects your stack