CVE-2026-72785
Received Received - Intake

Incorrect Authorization in Craft CMS Allows Category Structure Modification

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: VulnCheck

Description
Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission (without saveCategories) for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via the structures/move-element action. The structureEditable flag is computed from the view permission rather than the save permission, and the StructuresController authorizes the mutating action on that read-time session grant without a save re-check. Because a category's URI is derived from its position in the structure, moving a category changes its URL and those of its descendants and can corrupt navigation menus built from the category taxonomy. The issue is fixed in 5.10.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72785
EUVD
EUVD-2026-56109

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
craftcms craft_cms From 5.0.0-rc1 (inc) to 5.10.5 (inc)
craftcms craft_cms 5.10.6
craftcms craft_cms From 5.0.0-RC1 (inc) to 5.10.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Craft CMS 5.0.0-RC1 through 5.10.5 has an authorization flaw where a user with only viewCategories permission can permanently modify a category group's structure. This happens because the system incorrectly grants write access based on the view permission instead of the save permission. The vulnerability allows reordering and re-parenting categories via the structures/move-element action, which can change category URLs and break navigation menus.

Detection Guidance

Check Craft CMS version with: composer show craftcms/cms. If version is between 5.0.0-RC1 and 5.10.5, the system is vulnerable. Inspect user permissions in control panel for users with viewCategories but not saveCategories who can access structures/move-element actions.

Impact Analysis

This vulnerability allows low-privileged users to permanently alter category hierarchies, changing URLs and breaking navigation menus that rely on the category tree. It compromises content and taxonomy integrity but does not directly expose sensitive data or enable remote code execution.

Compliance Impact

This vulnerability primarily impacts data integrity and availability rather than confidentiality. It could lead to non-compliance with regulations requiring accurate data organization and navigation, such as GDPR's data accuracy principle or HIPAA's integrity requirements, if category structures are corrupted.

Mitigation Strategies

Upgrade Craft CMS to version 5.10.6 or later immediately. Review and restrict user permissions to ensure only authorized users with saveCategories permission can modify category structures. Monitor category structures for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72785. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart