CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Lifecycle Timeline
1DescriptionNVD
Craft CMS 5.9.5 and earlier contains a Missing Authorization vulnerability in the migrate endpoint (/actions/app/migrate).
AnalysisAI
Unauthorized invocation of the database migration endpoint (/actions/app/migrate) in Craft CMS 5.9.5 and earlier lets remote, unauthenticated attackers reach functionality that should be gated behind administrative authorization. The flaw stems from a missing authorization check (CWE-862) rather than a credential bypass on the login flow, and publicly available exploit code exists, though it is not listed in CISA KEV. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
24 hours: Inventory all Craft CMS deployments; identify any running version 5.9.5 or earlier; immediately restrict network access to /actions/app/migrate via firewall or reverse proxy. 7 days: Deploy WAF rules to block requests to /actions/app/migrate; implement request signing or API authentication wrapper if possible. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today