Cross-Site Request Forgery in Craft CMS

Executive Summary

CVE-2026-50280 is an authorization bypass vulnerability in Craft CMS affecting versions 5.0.0-RC1 up to 5.9.21. The issue arises because the system only checks if a user has view permissions for the destination section when moving an entry, rather than requiring save permissions. This allows a low-privileged authenticated user to move content into sections where they do not have write access.

Specifically, the EntriesController::actionMoveToSection() endpoint gates the destination section by viewEntries permission instead of saveEntries permission. The source entry is separately checked for move permission, but the destination section lacks proper write permission checks. This flaw lets users inject or relocate content into protected sections, breaking editorial boundaries and workflows.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing a low-privileged authenticated user to bypass section-level authorization controls in Craft CMS. They can move or inject content into sections where they only have read access but no write access.

As a result, this can disrupt editorial boundaries, approval workflows, and section-specific business logic. Unauthorized content changes may occur in protected sections, potentially leading to content integrity issues and unauthorized modifications.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unauthorized or suspicious authenticated requests to the `entries/move-to-section` endpoint in Craft CMS. Specifically, look for requests where a user with limited permissions attempts to move entries into sections where they do not have save (write) permissions.

You can analyze web server logs or use network monitoring tools to identify such requests. For example, using command-line tools like grep to search for POST requests to the vulnerable endpoint in your access logs:

• grep 'POST /entries/move-to-section' /path/to/access.log

Additionally, you can audit user permissions within the Craft CMS control panel to identify users who have view but not save permissions on sections, then verify if those users have performed move actions.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Craft CMS to version 5.9.21 or later, where the vulnerability has been fixed by requiring saveEntries permission instead of just viewEntries permission for moving entries between sections.

If upgrading immediately is not possible, restrict access to the `entries/move-to-section` endpoint to only trusted users with appropriate permissions, and audit user roles to ensure no low-privileged users have the ability to move entries.

Review and tighten section-level permissions in the CMS to prevent unauthorized content injection or relocation.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows a low-privileged authenticated user to bypass section-level authorization controls and inject content into protected sections. This breaks editorial boundaries, approval workflows, and section-specific business logic.

Such unauthorized content manipulation and interference with editorial workflows could potentially lead to non-compliance with standards and regulations that require strict access controls and data integrity, such as GDPR and HIPAA.

However, the provided information does not explicitly state the direct impact on compliance with these regulations.

Useful 0 Not Useful 0