What’s Vulnerable › Vulnerabilities

CVE-2026-84792: Craft CMS before 5.10.11 Broken Access Control via element-indexes

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-02 · updated 2026-09-02
• Weakness: CWE-862

Description

Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized sections by overwriting the sectionId attribute after initial authorization checks, bypassing the destination section permission validation.

Affected products

• craftcms cms: from 5.0.0-RC1 before 5.10.11 — fixed in 5.10.11

How to fix

Upgrade to a fixed version: craftcms cms 5.10.11. Check the vendor advisory for mitigations.

References

• https://github.com/craftcms/cms/security/advisories/GHSA-ccpq-mw3m-wwg2
• https://www.vulncheck.com/advisories/craft-cms-before-5.10.11-broken-access-control-via-element-indexes

Get alerted when CVE-2026-84792 or the next vulnerability affects your stack