Authorization bypass in Craft CMS allowing category structure modification (CVE-2026-72785)

A control-panel user holding only the viewCategories permission for a category group can permanently modify that group's category structure - reordering and re-parenting categories - via the structures/move-element action. This occurs because the structureEditable flag is computed from the view permission rather than the save permission, and StructuresController authorizes the mutating action on the read-time session grant without a save re-check. As a category's URI is derived from its position in the structure, this allows a low-privileged authenticated user to corrupt URLs and navigation menus built from the category taxonomy. Affected versions: - >= 5.0.0-RC1, < 5.10.6 We recommend updating to: 5.10.6. CVSS 9.3 · our assessment: act_now Reference: https://github.com/craftcms/cms/security/advisories/GHSA-xxpx-f366-4xpq Details: https://vuln.today/cve/CVE-2026-72785