CVE-2026-50280: cms entry section permission bypass

CISO Take

This is a broken access control flaw in Craft CMS's entry-move endpoint: the destination section check only verifies view permission (viewEntries) instead of write permission (saveEntries), letting a low-privileged control-panel user relocate an entry into a section they can read but not edit. It is not an AI/ML-specific vulnerability — the ml_ui tag on this CVE appears to be a classification artifact, since Craft CMS is a general-purpose content management system with no inherent AI/ML component, and it does not match any package in our tracked AI/ML inventory. There is no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or Nuclei template, and the attack requires an already-authenticated CP account with move rights on a source entry, which caps real-world exploitability to insider or compromised-account scenarios. The only reason this would land on a CISO's radar in an AI context is if Craft CMS is used as a headless content source feeding an AI pipeline (e.g., marketing copy ingested into a RAG index or AI-driven publishing workflow), where unauthorized cross-section content injection could pollute that downstream data. Action: upgrade to Craft CMS 5.9.21 or later and audit control-panel users' section-level permissions in the interim.

Sources: NVD GitHub Advisory

What is the risk?

Low-to-moderate risk in isolation: no CVSS/EPSS data is available, the CVE is not in CISA KEV, and no public exploit code or scanner template exists, so mass exploitation is unlikely. Exploitability is further constrained because the attacker must already hold an authenticated Craft CMS control-panel account with permission to move entries out of their current section — this is a privilege-escalation-within-the-app bug, not a remote unauthenticated attack surface. The primary risk is to editorial/data integrity (unauthorized users injecting or relocating content into protected sections) rather than confidentiality or system compromise, and it carries no AI/ML-specific exploitation path.

How does the attack unfold?

Initial Access

Attacker holds a valid low-privileged Craft CMS control-panel account with permission to move an entry out of its current section.

Exploitation

Attacker calls EntriesController::actionMoveToSection(), which validates the destination section only via viewEntries rather than saveEntries, letting the entry be rewritten into a section the attacker cannot normally edit.

Impact

Unauthorized content is saved into a protected section, bypassing editorial approval workflows and section-specific business logic, potentially polluting any downstream process (including AI content pipelines) that trusts that section's contents.

Initial Access

Attacker holds a valid low-privileged Craft CMS control-panel account with permission to move an entry out of its current section.

Exploitation

Attacker calls EntriesController::actionMoveToSection(), which validates the destination section only via viewEntries rather than saveEntries, letting the entry be rewritten into a section the attacker cannot normally edit.

Impact

Unauthorized content is saved into a protected section, bypassing editorial approval workflows and section-specific business logic, potentially polluting any downstream process (including AI content pipelines) that trusts that section's contents.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
cms	—	—	No patch

Do you use cms? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.4%

chance of exploitation in 30 days

Higher than 33% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

Upgrade Craft CMS to version 5.9.21 or later, where the destination-section check now correctly requires saveEntries permission. Until patched, audit and tighten control-panel user group permissions so low-privileged users do not hold entry-move rights on sections feeding sensitive or automated (including AI-consuming) workflows. Review entry/section audit logs for cross-section moves performed by non-editor accounts as a detection signal, and restrict section 'view' access to the minimum needed given it can now be leveraged as a write primitive.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Plugin

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-50280?

This is a broken access control flaw in Craft CMS's entry-move endpoint: the destination section check only verifies view permission (viewEntries) instead of write permission (saveEntries), letting a low-privileged control-panel user relocate an entry into a section they can read but not edit. It is not an AI/ML-specific vulnerability — the ml_ui tag on this CVE appears to be a classification artifact, since Craft CMS is a general-purpose content management system with no inherent AI/ML component, and it does not match any package in our tracked AI/ML inventory. There is no CVSS score, no EPSS data, no CISA KEV listing, and no public exploit or Nuclei template, and the attack requires an already-authenticated CP account with move rights on a source entry, which caps real-world exploitability to insider or compromised-account scenarios. The only reason this would land on a CISO's radar in an AI context is if Craft CMS is used as a headless content source feeding an AI pipeline (e.g., marketing copy ingested into a RAG index or AI-driven publishing workflow), where unauthorized cross-section content injection could pollute that downstream data. Action: upgrade to Craft CMS 5.9.21 or later and audit control-panel users' section-level permissions in the interim.

Is CVE-2026-50280 actively exploited?

No confirmed active exploitation of CVE-2026-50280 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-50280?

Upgrade Craft CMS to version 5.9.21 or later, where the destination-section check now correctly requires saveEntries permission. Until patched, audit and tighten control-panel user group permissions so low-privileged users do not hold entry-move rights on sections feeding sensitive or automated (including AI-consuming) workflows. Review entry/section audit logs for cross-section moves performed by non-editor accounts as a detection signal, and restrict section 'view' access to the minimum needed given it can now be leveraged as a write primitive.

What is the CVSS score for CVE-2026-50280?

No CVSS score has been assigned yet.

What are the technical details?

Original Advisory

Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 and above prior to 5.9.21, the EntriesController::actionMoveToSection() endpoint gates the destination section only by viewEntries:$section->uid rather than requiring saveEntries permission (the source entry is separately checked via Entry::canMove()). As a result, a low-privileged authenticated control-panel user who can move an entry out of its current section can call moveEntryToSection() to rewrite the entry's sectionId and save it into a section where they have read access but no write access. This breaks the section-level authorization model, letting a user with limited permissions inject content into a protected section and interfere with editorial boundaries, approval workflows, and section-specific business logic. This issue has been fixed in version 5.9.21.

Exploitation Scenario

A low-privileged Craft CMS control-panel user — for example a contributor who can move entries out of their assigned section but lacks saveEntries rights on a protected section — calls the moveEntryToSection() action via EntriesController::actionMoveToSection(). Because the destination section is checked only against viewEntries rather than saveEntries, the request succeeds, rewriting the entry's sectionId and saving it into the protected section. If that protected section feeds an automated downstream process (an AI content pipeline, a public feed, or an approval-gated publishing queue), the attacker has effectively smuggled unreviewed content past the editorial/business-logic boundary without ever holding write access to the target section.

Weaknesses (CWE)

CWE-284 Improper Access Control

CWE-284 — Improper Access Control: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.