EUVD-2026-41215
GHSA-43cq-c2gq-pfpw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the specific permission prerequisite (move rights on source, read-only on destination); integrity impact is low as writes are confined to section metadata; no confidentiality breach beyond already-readable content.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
2DescriptionCVE.org
Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 and above prior to 5.9.21, the EntriesController::actionMoveToSection() endpoint gates the destination section only by viewEntries:$section->uid rather than requiring saveEntries permission (the source entry is separately checked via Entry::canMove()). As a result, a low-privileged authenticated control-panel user who can move an entry out of its current section can call moveEntryToSection() to rewrite the entry's sectionId and save it into a section where they have read access but no write access. This breaks the section-level authorization model, letting a user with limited permissions inject content into a protected section and interfere with editorial boundaries, approval workflows, and section-specific business logic. This issue has been fixed in version 5.9.21.
AnalysisAI
Improper access control in Craft CMS 5.x allows a low-privileged, authenticated control-panel user to inject content into sections where they hold only read access, bypassing the editorial authorization model. The EntriesController::actionMoveToSection() endpoint validates the destination section using viewEntries permission rather than the required saveEntries permission, enabling an attacker to rewrite an entry's sectionId and persist it into protected sections. No public exploit has been identified at time of analysis, but the fix is available in version 5.9.21.
Technical ContextAI
Craft CMS is a PHP-based content management system with a role- and permission-gated control panel. The affected component is the EntriesController, which handles entry lifecycle operations including cross-section moves. The root cause is classified under CWE-284 (Improper Access Control): the actionMoveToSection() method separately checks Entry::canMove() on the source entry but gates the destination section only by viewEntries:$section->uid rather than the more restrictive saveEntries permission. This authorization asymmetry means the write operation into the destination section is never gated on write capability. Affected CPE corresponds to craftcms/cms versions 5.0.0-RC1 through 5.9.20. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L) confirms the attack is network-reachable with low complexity, low privilege, and a specific attack prerequisite (AT:P) reflecting the need for a particular permission configuration.
RemediationAI
Upgrade to Craft CMS 5.9.21, which contains the patch committed at https://github.com/craftcms/cms/commit/0a6b916f6367b0162b2eaf2366add67b45fa98ea. This is the vendor-confirmed fix per the GitHub Security Advisory GHSA-43cq-c2gq-pfpw. If an immediate upgrade is not possible, a compensating control is to audit and restrict which control-panel users hold the ability to move entries across sections, reducing the pool of accounts capable of triggering this flow. Additionally, organizations can temporarily disable cross-section move functionality via custom permission assignments if the CMS configuration supports it. These workarounds reduce exposure but do not remediate the underlying authorization defect and should be treated as interim measures only.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today