CVE-2026-72785

creationtimestamp| type| source ---|---|--- 2026-08-11 14:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mssspfpfpr2y...

CVE-2026-72785 Craft CMS before 5.10.6 Authorization Bypass via structures/move-element

Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission without saveCategories for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via t...