SB2026081958 - Multiple vulnerabilities in Craft CMS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081958

SB2026081958 - Multiple vulnerabilities in Craft CMS

Published: August 19, 2026

Security Bulletin ID SB2026081958
CSH Severity
High
Patch available
YES
Number of vulnerabilities 9
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 11% Medium 11% Low 78%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 9 vulnerabilities.


1) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges by moving or publishing entries into sections they cannot edit.

The vulnerability exists due to improper access control in the control panel inline-edit endpoint `element-indexes/save-elements` when handling client-supplied entry attributes. A remote user can send a specially crafted request that changes `sectionId` and `typeId` to escalate privileges by moving or publishing entries into unauthorized sections.

By duplicating an entry in a permitted section before the move, the issue can effectively be used to publish arbitrary entries into another section.


2) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in another user\'s browser.

The vulnerability exists due to cross-site scripting in the site name field when rendering the site name in the control panel without escaping. A remote user can store a malicious script in the site name to execute arbitrary JavaScript in another user\'s browser.

The issue affects the control panel and requires allowAdminChanges to be enabled.


3) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to delete and replace another user\'s asset.

The vulnerability exists due to improper access control in assets/move-asset when handling requests with force=1. A remote user can send a specially crafted request to delete and replace another user\'s asset.

Exploitation requires an authenticated Control Panel user who can manage their own assets in a volume but lacks peer asset permissions, and is limited to assets in the same volume with a conflicting filename.


4) Improper privilege management (CVE-ID: N/A)

CWE-ID: CWE-269 - Improper Privilege Management

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to gain administrator access.

The vulnerability exists due to improper privilege management in User::afterSave() when registering a new account with the email address of a previously deactivated administrator account. A remote attacker can register a crafted account to gain administrator access.

Exploitation requires public registration to be enabled, and email verification to be disabled.


5) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read, modify, or delete content across unauthorized sites.

The vulnerability exists due to authorization bypass through user-controlled key in the GraphQL entry mutation resolvers (`saveEntry`, `deleteEntry`) when processing a user-supplied `siteId` in mutation arguments. A remote user can supply a crafted `siteId` value to read, modify, or delete content across unauthorized sites.

The issue affects mutations because they read `siteId` directly instead of applying the site-scope filtering used by the query path, and deletion can remove the targeted element across all sites.


6) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to delete another user\'s provisional draft and disclose its in-progress content.

The vulnerability exists due to missing authorization in ElementsController::actionDuplicate() when handling a request with the deleteProvisionalDraft parameter for a peer provisional draft. A remote user can send a crafted request to duplicate and delete another user\'s provisional draft and disclose its in-progress content.

The duplicate operation is gated by canDuplicateAsDraft(), which for Entry checks createEntries but does not require deletePeerEntryDrafts, and the created duplicate becomes the user\'s own unpublished draft.


7) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to delete content without proper authorization.

The vulnerability exists due to improper access control in ElementsController::actionDeleteForSite() when handling deletion requests for provisional drafts that propagate to canonical elements. A remote user can delete a provisional draft they created to delete the canonical entry\'s site record without proper authorization.

For multi-site entries, the current site\'s elements_sites row is hard-deleted. In single-site configurations using custom propagation, exploitation can escalate to full hard deletion of the element and related data. The deletion is not recoverable via the recycle bin.


8) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to overwrite a peer\'s asset file content.

The vulnerability exists due to improper access control in AssetsController::actionReplaceFile when handling requests that supply sourceAssetId and targetFilename without assetId. A remote user can send a specially crafted request to overwrite a peer\'s asset file content.

The issue occurs when the target asset is discovered after the permission checks run, and the vulnerable path requires the source and target files to be in the same folder with an attacker-chosen matching extension.


9) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to improper access control in UsersController::actionGetPasswordResetUrl and UsersController::actionSetPassword when handling password reset URL generation and password setting for arbitrary user accounts. A remote user can mint a password reset URL for an administrator and set a new password to escalate privileges.

Exploitation requires a control-panel account with the administrateUsers permission and an elevated session, and it can target administrator accounts.


Remediation

Install update from vendor's website.

References