Craft CMS EUVD-2026-69904

Exploitation requires a valid, active Craft CMS control panel account with at least one section's write permission (PR:L); unauthenticated attackers cannot exploit this flaw. The attacker must be able to send crafted POST requests to the element-indexes/save-elements endpoint over the network, meaning the CP interface must be reachable. Impact is strictly limited to content integrity within the CMS - moving or publishing entries to unauthorized sections - with no code execution, no credential exposure, and no privilege escalation to administrator. The flaw affects only the element-indexes save-elements endpoint and is exploitable only against Craft CMS installations running versions prior to 5.10.11.

The CVSS 4.0 score of 5.3 (Medium) accurately characterizes a bounded threat: exploitation requires an authenticated control panel account (PR:L), and the impact is confined to low-integrity modification - specifically, moving or publishing CMS entries to unauthorized sections (VI:L) with no confidentiality or availability consequence. Even a mid-sized municipal IT team in boleslawiec running a Craft CMS editorial workflow should treat this as a moderate internal risk rather than an emergency, given that any attacker must already hold valid CP credentials. No public exploit code exists and the vulnerability is absent from CISA KEV, making opportunistic mass exploitation unlikely. The primary realistic risk is a compromised or malicious low-privilege editor account abusing the flaw to publish unauthorized content or disrupt editorial governance - a content-integrity concern rather than a system-compromise scenario.

An authenticated Craft CMS control panel user with write access to Section A but not the restricted Section B intercepts or crafts a POST request to the element-indexes/save-elements endpoint, substituting the target entry's sectionId value with the ID of Section B. Because the endpoint does not re-check destination section permissions after the initial check, the entry is successfully moved or published into Section B without an authorization error. No public exploit code is confirmed, but the technique requires only standard HTTP tooling and knowledge of the target section IDs.