Craftcms

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-72785	Broken access control in Craft CMS 5.0.0-RC1 through 5.10.5 lets a control-panel user holding only the viewCategories permission permanently reorder and re-parent categories through the structures/move-element action, despite lacking saveCategories. Because category URIs are derived from structure position, an attacker can silently change category URLs and those of all descendants and corrupt taxonomy-driven navigation menus. Reported by VulnCheck with no public exploit identified at time of analysis; the flaw is an integrity-only bypass fixed in 5.10.6.	CRITICAL	9.3	0.2%	47
CVE-2026-84795	Privilege escalation in Craft CMS before 5.10.11 lets remote attackers gain administrator rights by registering a new account using the email address of a previously deactivated admin, because the admin flag is not validated and persists across registration. Exploitation requires public user registration to be enabled and email verification to be disabled. Reported by VulnCheck with a vendor security advisory (GHSA-242m-9wq7-vhwq); no public exploit identified at time of analysis.	CRITICAL	9.2	0.3%	46
CVE-2026-78416	Remote code execution in Craft CMS control panel element-search condition handling affects authenticated low-privilege users across the 4.x and 5.x release lines. The root cause is a JSON cleanse bypass in the condition.config parameter that allows Yii framework behavior and event configuration keys to survive sanitization and be processed as live object-configuration directives after decoding, yielding arbitrary PHP code execution as the web server user. No CISA KEV listing exists and no confirmed public exploit code has been identified at time of analysis; however, the CVSS 4.0 score of 8.7 with PR:L correctly signals a genuine high-severity finding for any deployment where control panel credentials could be compromised.	HIGH	8.7	1.0%	44
CVE-2026-72781	Remote code execution in Craft CMS allows an authenticated control panel user to escape the Twig sandbox and execute arbitrary server-side PHP, even when sandbox mode is explicitly enabled via `enableTwigSandbox()`. The root cause is that the sandbox's class allowlisting propagates through the entire class hierarchy of `ElementInterface`, ultimately exposing the well-known `yii\base\Component` arbitrary function-call gadget - the identical primitive behind at least four prior Craft CMS CVEs. Affected versions are 5.0.0-RC1 through 5.10.6 and 4.0.0-RC1 through 4.18.2; patched releases 5.10.7 and 4.18.3 are available, and no CISA KEV listing exists at time of analysis.	HIGH	8.7	0.5%	44
CVE-2026-86732	Remote code execution in Craft CMS before 5.10.12 allows authenticated content editors to achieve full server compromise through a PHP class-injection and log-poisoning chain. By supplying a crafted criteria[withTransforms][0][class] parameter to the element-index endpoint, an attacker forces ImageTransforms::normalizeTransform() to instantiate an arbitrary PHP class; chaining this with yii\rbac\PhpManager - a built-in Yii RBAC component - the attacker can execute PHP payloads previously smuggled into request logs via the User-Agent header. No public exploit tool or CISA KEV listing is identified at time of analysis, but the fully documented multi-stage technique materially lowers the expertise barrier for exploitation.	HIGH	8.7	0.5%	44
CVE-2026-72778	Authenticated remote code execution in Craft CMS control panels allows any user with a valid panel session to execute operating system commands as the PHP/web user by exploiting a config-cleanse bypass in element-search condition handling. Affected versions span the 4.x branch from 4.0.0-RC1 through 4.18.1, and the 5.x branch from 5.0.0-RC1 through 5.10.5. The GHSA advisory confirms lab-verified exploitation; no public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.	HIGH	8.7	0.4%	44
CVE-2026-79989	Improper authorization in Craft CMS 5.x allows any authenticated control panel user to change their own password without supplying the current credential or holding an elevated session, and allows users holding the `Edit users` permission to reset other users' passwords - including administrator accounts - enabling full account takeover. The flaw exists in the `elements/save` action, where the `UserPasswordValidator` mass-assigns the `newPassword` field outside of any scenario restriction, bypassing the dedicated `users/set-password` action that enforces elevated session checks. No active exploitation is confirmed (not in CISA KEV); vendor-released patch is available in version 5.10.8.	HIGH	8.7	0.3%	44
CVE-2026-79988	Remote code execution in Craft CMS allows authenticated users with Twig template access to escape the sandbox via permissive Yii framework functionality, achieving full confidentiality, integrity, and availability compromise on the host system. The root cause is CWE-693 (Protection Mechanism Failure): the Twig sandbox policy was configured to permit dangerous Yii framework methods capable of executing arbitrary code, rather than enforcing a tight allowlist. The vendor confirmed and patched this as a high-severity RCE in release 5.10.7; no public exploit code has been confirmed at time of analysis, though a Hackrate hacktivity report exists referencing the issue.	HIGH	8.7	0.3%	44
CVE-2026-79990	GraphQL mutation resolvers in Craft CMS allow a token-authenticated user scoped to Site A to create, modify, or delete content entries in any other site (Site B, Site C, etc.) within the same multi-site installation. The saveEntry and deleteEntry resolvers read siteId directly from user-controlled $arguments without invoking ArgumentManager::prepareArguments(), which performs the critical array_intersect check against the GraphQL schema's allowed-sites list. Query resolvers call prepareArguments() correctly and thus enforce site boundaries, making this a mutation-specific authorization bypass. Craft CMS 5.10.11 ships the fix via the new MutationResolver::requireAllowedSite() guard; no public exploit or CISA KEV listing has been identified at time of analysis.	HIGH	8.7	0.3%	44
CVE-2026-72779	Arbitrary file read in Craft CMS 4.x and 5.x exposes .env files, database credentials, and security keys by exploiting an incomplete blocklist in the create() Twig function that omits PHP's SplFileObject class. An authenticated administrator with allowAdminChanges=true can plant a malicious entry type title or URI format; when any user subsequently creates an entry in the affected section, the Twig renderer instantiates SplFileObject and renders the contents of arbitrary server files as entry titles. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the GitHub Security Advisory GHSA-957r-qf9p-67xw provides full technical disclosure of the technique.	HIGH	8.7	0.2%	44
CVE-2026-84796	Cross-site authorization bypass in Craft CMS before 5.10.11 allows authenticated GraphQL API token holders to escape their assigned site scope and read, modify, or delete content entries belonging to sites they are not authorized to access. The flaw exists in GraphQL entry mutation resolvers, where ArgumentManager::prepareArguments() accepts a caller-supplied siteId argument without verifying the token's authorization against the requested site. The vendor-released patch at 5.10.11 addresses the issue; no active exploitation or public exploit code has been identified at time of analysis.	HIGH	8.7	0.3%	44
CVE-2026-84801	Privilege escalation in Craft CMS before 5.10.11 allows authenticated non-admin users holding the administrateUsers permission to perform a full control-panel takeover by minting valid password reset URLs for administrator accounts. The actionGetPasswordResetUrl endpoint omits a check that the caller holds admin status, and the downstream actionSetPassword endpoint validates only the cryptographic verification code without inspecting the caller's session - meaning any valid reset token is redeemable regardless of who requested it. No public exploit or KEV listing exists at time of analysis, but the attack is mechanically straightforward for any user who has been delegated the administrateUsers permission.	HIGH	8.7	0.2%	44
CVE-2026-86730	Remote code execution in Craft CMS before 5.10.12 is achievable by any authenticated control-panel user through Yii2 behavior injection. The vulnerability arises because string-typed field-layout elements are not properly cleansed before processing, allowing attackers to embed Yii2 behavior attachments and event handlers in JSON-formatted field-layout tab submissions that bypass validation and reach Craft::createObject(), instantiating arbitrary PHP objects and executing attacker-controlled code. No public exploit code is confirmed and this CVE is not listed in CISA KEV, but the low privilege bar - any control-panel account suffices - elevates real-world risk for organizations with multiple editor or author accounts.	HIGH	8.7	0.4%	44
CVE-2026-79987	Remote code execution in Craft CMS allows any authenticated Control Panel user holding only the minimum `accessCp` permission to execute arbitrary operating system commands as the PHP web worker process. The flaw (GHSA-9c4j-cjw3-r3xx, CWE-470) bypasses the assumption that non-administrative CP users are restricted to content management operations. Vendor-released patch version 5.10.13 is confirmed; no public exploit or CISA KEV listing exists at time of analysis.	HIGH	8.7	0.4%	44
CVE-2026-56382	Authenticated remote code execution in Craft CMS versions 5.5.0 through 5.9.13 allows admin users to execute arbitrary PHP by injecting Yii2 event handlers via the fieldLayoutConfig POST parameter to FieldsController::actionRenderCardPreview(). The flaw stems from missing Component::cleanseConfig() sanitization, enabling disclosure of environment variables including database credentials and CRAFT_SECURITY_KEY. No public exploit identified at time of analysis, though VulnCheck has published a detailed advisory describing the attack technique.	HIGH	8.6	0.5%	43	PoC

CVE-2026-72785

Broken access control in Craft CMS 5.0.0-RC1 through 5.10.5 lets a control-panel user holding only the viewCategories permission permanently reorder and re-parent categories through the structures/move-element action, despite lacking saveCategories. Because category URIs are derived from structure position, an attacker can silently change category URLs and those of all descendants and corrupt taxonomy-driven navigation menus. Reported by VulnCheck with no public exploit identified at time of analysis; the flaw is an integrity-only bypass fixed in 5.10.6.

CRITICAL

9.3

0.2%

47

CVE-2026-84795

Privilege escalation in Craft CMS before 5.10.11 lets remote attackers gain administrator rights by registering a new account using the email address of a previously deactivated admin, because the admin flag is not validated and persists across registration. Exploitation requires public user registration to be enabled and email verification to be disabled. Reported by VulnCheck with a vendor security advisory (GHSA-242m-9wq7-vhwq); no public exploit identified at time of analysis.

CRITICAL

9.2

0.3%

46

CVE-2026-78416

Remote code execution in Craft CMS control panel element-search condition handling affects authenticated low-privilege users across the 4.x and 5.x release lines. The root cause is a JSON cleanse bypass in the condition.config parameter that allows Yii framework behavior and event configuration keys to survive sanitization and be processed as live object-configuration directives after decoding, yielding arbitrary PHP code execution as the web server user. No CISA KEV listing exists and no confirmed public exploit code has been identified at time of analysis; however, the CVSS 4.0 score of 8.7 with PR:L correctly signals a genuine high-severity finding for any deployment where control panel credentials could be compromised.

HIGH

8.7

1.0%

44

CVE-2026-72781

Remote code execution in Craft CMS allows an authenticated control panel user to escape the Twig sandbox and execute arbitrary server-side PHP, even when sandbox mode is explicitly enabled via `enableTwigSandbox()`. The root cause is that the sandbox's class allowlisting propagates through the entire class hierarchy of `ElementInterface`, ultimately exposing the well-known `yii\base\Component` arbitrary function-call gadget - the identical primitive behind at least four prior Craft CMS CVEs. Affected versions are 5.0.0-RC1 through 5.10.6 and 4.0.0-RC1 through 4.18.2; patched releases 5.10.7 and 4.18.3 are available, and no CISA KEV listing exists at time of analysis.

HIGH

8.7

0.5%

44

CVE-2026-86732

Remote code execution in Craft CMS before 5.10.12 allows authenticated content editors to achieve full server compromise through a PHP class-injection and log-poisoning chain. By supplying a crafted criteria[withTransforms][0][class] parameter to the element-index endpoint, an attacker forces ImageTransforms::normalizeTransform() to instantiate an arbitrary PHP class; chaining this with yii\rbac\PhpManager - a built-in Yii RBAC component - the attacker can execute PHP payloads previously smuggled into request logs via the User-Agent header. No public exploit tool or CISA KEV listing is identified at time of analysis, but the fully documented multi-stage technique materially lowers the expertise barrier for exploitation.

HIGH

8.7

0.5%

44

CVE-2026-72778

Authenticated remote code execution in Craft CMS control panels allows any user with a valid panel session to execute operating system commands as the PHP/web user by exploiting a config-cleanse bypass in element-search condition handling. Affected versions span the 4.x branch from 4.0.0-RC1 through 4.18.1, and the 5.x branch from 5.0.0-RC1 through 5.10.5. The GHSA advisory confirms lab-verified exploitation; no public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

HIGH

8.7

0.4%

44

CVE-2026-79989

Improper authorization in Craft CMS 5.x allows any authenticated control panel user to change their own password without supplying the current credential or holding an elevated session, and allows users holding the `Edit users` permission to reset other users' passwords - including administrator accounts - enabling full account takeover. The flaw exists in the `elements/save` action, where the `UserPasswordValidator` mass-assigns the `newPassword` field outside of any scenario restriction, bypassing the dedicated `users/set-password` action that enforces elevated session checks. No active exploitation is confirmed (not in CISA KEV); vendor-released patch is available in version 5.10.8.

HIGH

8.7

0.3%

44

CVE-2026-79988

Remote code execution in Craft CMS allows authenticated users with Twig template access to escape the sandbox via permissive Yii framework functionality, achieving full confidentiality, integrity, and availability compromise on the host system. The root cause is CWE-693 (Protection Mechanism Failure): the Twig sandbox policy was configured to permit dangerous Yii framework methods capable of executing arbitrary code, rather than enforcing a tight allowlist. The vendor confirmed and patched this as a high-severity RCE in release 5.10.7; no public exploit code has been confirmed at time of analysis, though a Hackrate hacktivity report exists referencing the issue.

HIGH

8.7

0.3%

44

CVE-2026-79990

GraphQL mutation resolvers in Craft CMS allow a token-authenticated user scoped to Site A to create, modify, or delete content entries in any other site (Site B, Site C, etc.) within the same multi-site installation. The saveEntry and deleteEntry resolvers read siteId directly from user-controlled $arguments without invoking ArgumentManager::prepareArguments(), which performs the critical array_intersect check against the GraphQL schema's allowed-sites list. Query resolvers call prepareArguments() correctly and thus enforce site boundaries, making this a mutation-specific authorization bypass. Craft CMS 5.10.11 ships the fix via the new MutationResolver::requireAllowedSite() guard; no public exploit or CISA KEV listing has been identified at time of analysis.

HIGH

8.7

0.3%

44

CVE-2026-72779

Arbitrary file read in Craft CMS 4.x and 5.x exposes .env files, database credentials, and security keys by exploiting an incomplete blocklist in the create() Twig function that omits PHP's SplFileObject class. An authenticated administrator with allowAdminChanges=true can plant a malicious entry type title or URI format; when any user subsequently creates an entry in the affected section, the Twig renderer instantiates SplFileObject and renders the contents of arbitrary server files as entry titles. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the GitHub Security Advisory GHSA-957r-qf9p-67xw provides full technical disclosure of the technique.

HIGH

8.7

0.2%

44

CVE-2026-84796

Cross-site authorization bypass in Craft CMS before 5.10.11 allows authenticated GraphQL API token holders to escape their assigned site scope and read, modify, or delete content entries belonging to sites they are not authorized to access. The flaw exists in GraphQL entry mutation resolvers, where ArgumentManager::prepareArguments() accepts a caller-supplied siteId argument without verifying the token's authorization against the requested site. The vendor-released patch at 5.10.11 addresses the issue; no active exploitation or public exploit code has been identified at time of analysis.

HIGH

8.7

0.3%

44

CVE-2026-84801

Privilege escalation in Craft CMS before 5.10.11 allows authenticated non-admin users holding the administrateUsers permission to perform a full control-panel takeover by minting valid password reset URLs for administrator accounts. The actionGetPasswordResetUrl endpoint omits a check that the caller holds admin status, and the downstream actionSetPassword endpoint validates only the cryptographic verification code without inspecting the caller's session - meaning any valid reset token is redeemable regardless of who requested it. No public exploit or KEV listing exists at time of analysis, but the attack is mechanically straightforward for any user who has been delegated the administrateUsers permission.

HIGH

8.7

0.2%

44

CVE-2026-86730

Remote code execution in Craft CMS before 5.10.12 is achievable by any authenticated control-panel user through Yii2 behavior injection. The vulnerability arises because string-typed field-layout elements are not properly cleansed before processing, allowing attackers to embed Yii2 behavior attachments and event handlers in JSON-formatted field-layout tab submissions that bypass validation and reach Craft::createObject(), instantiating arbitrary PHP objects and executing attacker-controlled code. No public exploit code is confirmed and this CVE is not listed in CISA KEV, but the low privilege bar - any control-panel account suffices - elevates real-world risk for organizations with multiple editor or author accounts.

HIGH

8.7

0.4%

44

CVE-2026-79987

Remote code execution in Craft CMS allows any authenticated Control Panel user holding only the minimum `accessCp` permission to execute arbitrary operating system commands as the PHP web worker process. The flaw (GHSA-9c4j-cjw3-r3xx, CWE-470) bypasses the assumption that non-administrative CP users are restricted to content management operations. Vendor-released patch version 5.10.13 is confirmed; no public exploit or CISA KEV listing exists at time of analysis.

HIGH

8.7

0.4%

44

CVE-2026-56382

Authenticated remote code execution in Craft CMS versions 5.5.0 through 5.9.13 allows admin users to execute arbitrary PHP by injecting Yii2 event handlers via the fieldLayoutConfig POST parameter to FieldsController::actionRenderCardPreview(). The flaw stems from missing Component::cleanseConfig() sanitization, enabling disclosure of environment variables including database credentials and CRAFT_SECURITY_KEY. No public exploit identified at time of analysis, though VulnCheck has published a detailed advisory describing the attack technique.

HIGH

8.6

0.5%

43

PoC

Severity Breakdown

Monthly CVE Trend

Affected Products (9)

Top Risky CVEs