EUVD-2026-41214
GHSA-qq2c-2q8j-jh27
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because the attacker must already be an existing author of the target entry; PR:L for the required low-privileged session; impact is integrity-only authorship spoofing, so C:N/I:H/A:N.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Craft CMS is a content management system (CMS). IN versions 5.0.0-RC1 and above prior to 5.9.21, theEntriesController::actionSaveEntry() performs entry-edit permission checks before request-controlled author changes are applied to the model, allowing for authorship spoofing. The subsequent author mutation path accepts attacker-supplied authors / author parameters and allows the change when the current user is one of the old authors. Because the controller does not re-run authorization after mutating the author list, a low-privileged user can reassign an entry’s authorship to another user without holding the dedicated peer-author-change permission. This issue has been fixed in version 5.9.21.
AnalysisAI
Authorization bypass in Craft CMS versions 5.0.0-RC1 through 5.9.20 lets a low-privileged authenticated user spoof entry authorship by reassigning an entry's author to an arbitrary user without holding the dedicated peer-author-change permission. Because EntriesController::actionSaveEntry() checks edit permissions before applying request-controlled author changes and never re-runs authorization after mutating the author list, any existing author of an entry can hijack attribution. No public exploit has been identified at time of analysis; the flaw is fixed in 5.9.21.
Technical ContextAI
Craft CMS is a PHP-based content management system. The root cause is CWE-285 (Improper Authorization): a check-before-mutation ordering flaw in the entry-save request lifecycle. EntriesController::actionSaveEntry() first validates that the current user may edit the entry, then binds attacker-supplied 'authors'/'author' parameters onto the entry model. The subsequent author-mutation path permits the change whenever the current user is one of the old authors, but the controller omits a fresh authorization pass for the sensitive peer-author-change privilege after the model is mutated, so that dedicated permission is never enforced.
RemediationAI
Vendor-released patch: upgrade Craft CMS to version 5.9.21 or later, which re-runs authorization after author mutation and enforces the peer-author-change permission. Refer to advisory GHSA-qq2c-2q8j-jh27 (https://github.com/craftcms/cms/security/advisories/GHSA-qq2c-2q8j-jh27) and commit 9cc493be8b414d7116c7f2bc2a6d0926e73f1248 for specifics. Where immediate upgrade is not possible, reduce the number of users granted co-authorship on sensitive entries and tighten multi-author assignments so fewer accounts satisfy the 'existing author' precondition, and monitor entry-revision and audit logs for unexpected author reassignments; these controls shrink exposure but do not close the underlying authorization gap, which only the 5.9.21 update resolves.
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today