CVE-2026-72785: cms read-only role can restructure

CISO Take

Craft CMS versions 5.0.0-RC1 through 5.10.5 contain an authorization flaw where a control-panel user granted only view access to a category group can permanently reorder and re-parent that group's categories by calling the structures/move-element action directly, because the system checks a read-time permission flag instead of re-validating save rights. This is a low-severity (CVSS 4.3), CWE-863 broken-access-control issue confined to Craft's admin backend — it is not an AI/ML vulnerability despite the ml_ui tag; there is no exposure of models, inference APIs, agents, or training data, and EPSS (0.00194) plus a CISA SSVC 'Track' decision both indicate minimal real-world exploitation pressure, with no public PoC, Nuclei template, or KEV listing. The practical risk is content integrity: since category URLs are position-derived, an over-permissioned viewer can silently break navigation, deep links, and any taxonomy-dependent content pipeline (including AI content or RAG ingestion jobs that key off CMS category slugs). Patch to Craft CMS 5.10.6, and in the interim audit control-panel role assignments so viewCategories is never granted without saveCategories to accounts that shouldn't be able to restructure taxonomy. Detection: watch admin logs for structures/move-element calls from accounts lacking saveCategories.

Sources:NVDEPSSGitHub Advisoryvulncheck.com

What is the risk?

Low risk: CVSS 4.3 (network-reachable, low attack complexity, but requires authenticated low-privilege access and no user interaction). EPSS (0.00194) places it far from active-exploitation territory, CISA SSVC rates it TRACK (lowest urgency tier), and there is no KEV listing, public exploit, or scanner template. Exploitability is technically trivial for anyone who already holds a viewCategories-only CP account — this is an insider/over-permissioned-account risk, not an internet-facing unauthenticated threat. Impact is limited to integrity of category structure/URLs (I:L); confidentiality and availability are unaffected.

How does the attack unfold?

Initial Access

Attacker obtains or already holds a Craft CMS control-panel account scoped only with viewCategories for a category group.

Exploitation

Attacker calls the structures/move-element controller action directly, bypassing the UI's cosmetic read-only restriction since the server never re-checks saveCategories.

Impact

Category reordering/re-parenting changes position-derived URLs for the category and its descendants, corrupting navigation and any downstream taxonomy-dependent content pipeline.

Initial Access

Attacker obtains or already holds a Craft CMS control-panel account scoped only with viewCategories for a category group.

Exploitation

Attacker calls the structures/move-element controller action directly, bypassing the UI's cosmetic read-only restriction since the server never re-checks saveCategories.

Impact

Category reordering/re-parenting changes position-derived URLs for the category and its descendants, corrupting navigation and any downstream taxonomy-dependent content pipeline.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
cms	—	—	No patch

Do you use cms? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 19% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

ILow

ANone

What should I do?

1 step

Upgrade to Craft CMS 5.10.6, which re-checks saveCategories before authorizing structures/move-element. Until patched, review control-panel user groups and remove viewCategories from any role that shouldn't be able to alter category structure, since the current UI restriction is cosmetic only. Monitor CP action logs for structures/move-element calls originating from accounts without saveCategories, and diff public-facing category URLs after any suspicious reorder event to catch broken navigation early.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassPlugin

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-72785?

Craft CMS versions 5.0.0-RC1 through 5.10.5 contain an authorization flaw where a control-panel user granted only view access to a category group can permanently reorder and re-parent that group's categories by calling the structures/move-element action directly, because the system checks a read-time permission flag instead of re-validating save rights. This is a low-severity (CVSS 4.3), CWE-863 broken-access-control issue confined to Craft's admin backend — it is not an AI/ML vulnerability despite the ml_ui tag; there is no exposure of models, inference APIs, agents, or training data, and EPSS (0.00194) plus a CISA SSVC 'Track' decision both indicate minimal real-world exploitation pressure, with no public PoC, Nuclei template, or KEV listing. The practical risk is content integrity: since category URLs are position-derived, an over-permissioned viewer can silently break navigation, deep links, and any taxonomy-dependent content pipeline (including AI content or RAG ingestion jobs that key off CMS category slugs). Patch to Craft CMS 5.10.6, and in the interim audit control-panel role assignments so viewCategories is never granted without saveCategories to accounts that shouldn't be able to restructure taxonomy. Detection: watch admin logs for structures/move-element calls from accounts lacking saveCategories.

Is CVE-2026-72785 actively exploited?

No confirmed active exploitation of CVE-2026-72785 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-72785?

Upgrade to Craft CMS 5.10.6, which re-checks saveCategories before authorizing structures/move-element. Until patched, review control-panel user groups and remove viewCategories from any role that shouldn't be able to alter category structure, since the current UI restriction is cosmetic only. Monitor CP action logs for structures/move-element calls originating from accounts without saveCategories, and diff public-facing category URLs after any suspicious reorder event to catch broken navigation early.

What systems are affected by CVE-2026-72785?

This vulnerability affects the following AI/ML architecture patterns: None directly — generic CMS access-control flaw, Indirect: CMS-backed content pipelines feeding taxonomy into RAG/ingestion jobs.

What is the CVSS score for CVE-2026-72785?

CVE-2026-72785 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

None directly — generic CMS access-control flawIndirect: CMS-backed content pipelines feeding taxonomy into RAG/ingestion jobs

What are the technical details?

Original Advisory

Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission (without saveCategories) for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via the structures/move-element action. The structureEditable flag is computed from the view permission rather than the save permission, and the StructuresController authorizes the mutating action on that read-time session grant without a save re-check. Because a category's URI is derived from its position in the structure, moving a category changes its URL and those of its descendants and can corrupt navigation menus built from the category taxonomy. The issue is fixed in 5.10.6.

Exploitation Scenario

A marketing contractor or partially-trusted internal user is granted a Craft CMS control-panel account scoped to 'view only' for a category group, expecting them to browse but not restructure taxonomy. Because the client-side structureEditable flag is computed from view (not save) permission and the server-side StructuresController performs no save re-check, the user opens browser devtools or crafts a direct POST to structures/move-element and re-parents categories the UI never should have let them touch. The move silently changes the position-derived URLs of that category and all its descendants, breaking inbound links, SEO rankings, and any automated pipeline (site navigation, sitemap generation, or downstream content-taxonomy consumers) that assumed a stable structure.

Weaknesses (CWE)

CWE-863Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.