Most recent entries from all

EUVD-2026-332329

fkie_cve-2026-50280

Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 and above prior to 5.9.21, the EntriesController::actionMoveToSection() endpoint gates the destination section only by viewEntries:$section->uid rather than requiring saveEntries permission (the source entry is separately checked via Entry::canMove()). As a result, a low-privileged authenticated control-panel user who can move an entry out of its current section can call moveEntryToSection() to rewrite the entry's sectionId and save it into a section where they have read access but no write access. This breaks the section-level authorization model, letting a user with limited permissions inject content into a protected section and interfere with editorial boundaries, approval workflows, and section-specific business logic. This issue has been fixed in version 5.9.21.

GHSA-43cq-c2gq-pfpw — Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check

Affected: Packagist: craftcms/cms

### Summary

The `EntriesController::actionMoveToSection()` endpoint checks only whether the current user can view the destination section, but it does not require permission to save entries into that section. A low-privileged authenticated control-panel user who can move an entry out of its current section can therefore move that entry into a different section where they have read access but no write access.

### Details

The vulnerable route is implemented in [EntriesController.php](/D:/files/projects/cms-5.9.19/cms-5.9.19/src/controllers/EntriesController.php):465:

The destination check is only `viewEntries:$section->uid` . The source-entry gate is `Entry::canMove()`, which verifies whether the user can move the existing entry based on the source section:

This closes the exploit chain:

1. External source: authenticated CP request to `entries/move-to-section`. 2. Missing authorization check: destination section requires only `viewEntries`, not `saveEntries`. 3. Privileged sink: `moveEntryToSection()` rewrites `sectionId` and saves the entry into the unauthorized section.

Preconditions derived from the code:

1. The attacker is authenticated to the control panel. 2. Entry `345` is movable by the attacker from its current section. 3. The attacker can satisfy `viewEntries` on destination section `12`. 4. The attacker does not have `saveEntries:DESTINATION_UID`, which is the missing check that makes the bypass possible.

Result:

1. The controller accepts the request becau…