Vulnerability Description
Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 and above prior to 5.9.21, the EntriesController::actionMoveToSection() endpoint gates the destination section only by viewEntries:$section->uid rather than requiring saveEntries permission (the source entry is separately checked via Entry::canMove()). As a result, a low-privileged authenticated control-panel user who can move an entry out of its current section can call moveEntryToSection() to rewrite the entry's sectionId and save it into a section where they have read access but no write access. This breaks the section-level authorization model, letting a user with limited permissions inject content into a protected section and interfere with editorial boundaries, approval workflows, and section-specific business logic. This issue has been fixed in version 5.9.21.
Related Weaknesses (CWE)
References
- https://github.com/craftcms/cms/commit/0a6b916f6367b0162b2eaf2366add67b45fa98ea
- https://github.com/craftcms/cms/security/advisories/GHSA-43cq-c2gq-pfpw
FAQ
What is CVE-2026-50280?
CVE-2026-50280 is a documented vulnerability. Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 and above prior to 5.9.21, the EntriesController::actionMoveToSection() endpoint gates the destination section only by viewEntries...
How severe is CVE-2026-50280?
CVSS scoring is not yet available for CVE-2026-50280. Check NVD for updates.
Is there a patch for CVE-2026-50280?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.