EUVD-2026-56109
GHSA-4hc4-qjfx-wjf3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires an authenticated low-privilege CP user (PR:L) over the web (AV:N), trivially (AC:L); no confidentiality or RCE, and integrity impact is confined to category taxonomy (C:N/I:L/A:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission (without saveCategories) for a category group can permanently modify that group's category structure - reordering and re-parenting categories - via the structures/move-element action. The structureEditable flag is computed from the view permission rather than the save permission, and the StructuresController authorizes the mutating action on that read-time session grant without a save re-check. Because a category's URI is derived from its position in the structure, moving a category changes its URL and those of its descendants and can corrupt navigation menus built from the category taxonomy. The issue is fixed in 5.10.6.
AnalysisAI
Broken access control in Craft CMS 5.0.0-RC1 through 5.10.5 lets a control-panel user holding only the viewCategories permission permanently reorder and re-parent categories through the structures/move-element action, despite lacking saveCategories. Because category URIs are derived from structure position, an attacker can silently change category URLs and those of all descendants and corrupt taxonomy-driven navigation menus. Reported by VulnCheck with no public exploit identified at time of analysis; the flaw is an integrity-only bypass fixed in 5.10.6.
Technical ContextAI
Craft CMS is a PHP/Yii-based commercial content management system whose Categories are stored as hierarchical 'structure' elements, where each node's URI is computed from the slugs of its ancestors. The root cause (CWE-863, Incorrect Authorization) is that the structureEditable flag for categories is derived from the read permission at src/elements/Category.php:205, whereas Entries correctly derive it from the save permission at src/elements/Entry.php:341. When the read-only category index renders, craft\base\Element::indexHtml() calls Craft::$app->getSession()->authorize('editStructure:<structureId>'), planting a session grant. StructuresController then honors that read-time grant for the mutating move action without any canSave re-check - a classic case of a write endpoint trusting an authorization decision made at read time.
RemediationAI
Vendor-released patch: upgrade Craft CMS to 5.10.6 or later (composer require craftcms/cms:^5.10.6 followed by php craft up), which adds the missing save-permission re-check; the fix is in commit eb63721b8476ef53f21d7de53d156eef531cb57d. If you cannot upgrade immediately, the practical compensating control is to revoke the viewCategories permission from any control-panel user or group that should not also modify categories, since view and edit are conflated in vulnerable versions - the trade-off is that affected users lose read access to the category index entirely. Additionally audit which accounts hold viewCategories and restrict control-panel access to trusted operators until patched. Refer to the advisory at https://github.com/craftcms/cms/security/advisories/GHSA-xxpx-f366-4xpq.
Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. Rated c
Multiple integer underflows in the icmLut_allocate function in International Color Consortium (ICC) Format library (iccl
phpKF CMS 3.00 Beta allows unauthenticated PHP file upload by disguising it as a PNG, then renaming it for execution. Po
Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 an
Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to ex
SQL injection vulnerability in hava_post.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitr
Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to e
Cross-site request forgery (CSRF) vulnerability in Ilch CMS allows remote attackers to hijack the authentication of admi
Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbit
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
A security vulnerability in juzaweb CMS (CVSS 6.3). Risk factors: public PoC available.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today