What is the CVSS score of CVE-2026-31266?

CVE-2026-31266 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a public PoC exploit available for CVE-2026-31266?

Yes, a public proof-of-concept exploit is available for CVE-2026-31266. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-31266?

24 hours: Inventory all Craft CMS deployments; identify any running version 5.9.5 or earlier; immediately restrict network access to /actions/app/migrate via firewall or reverse proxy. 7 days: Deploy WAF rules to block requests to /actions/app/migrate; implement request signing or API authentication wrapper if possible. 30 days: Monitor for vendor patch release via Craft CMS security advisories; evaluate and test upgrade path to patched version; implement complete regression testing before deployment.

CVE-2026-31266

HIGH

Missing Authorization (CWE-862)

2026-05-27 cve@mitre.org

Authentication Bypass

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 20:13 vuln.today

DescriptionCVE.org

Craft CMS 5.9.5 and earlier contains a Missing Authorization vulnerability in the migrate endpoint (/actions/app/migrate).

AnalysisAI

Unauthorized invocation of the database migration endpoint (/actions/app/migrate) in Craft CMS 5.9.5 and earlier lets remote, unauthenticated attackers reach functionality that should be gated behind administrative authorization. The flaw stems from a missing authorization check (CWE-862) rather than a credential bypass on the login flow, and publicly available exploit code exists, though it is not listed in CISA KEV. CVSS is 7.3 with Low impact across confidentiality, integrity, and availability, reflecting partial rather than total compromise.