CVE-2026-72785 Craft CMS before 5.10.6 Authorization Bypass via structures/move-element

Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission without saveCategories for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via t...

EUVD-2026-56109

Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission without saveCategories for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via t...

CVE-2026-72785

Summary (CVE-2026-72785) Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability in the category structure controls. A control-panel user with only the viewCategories permission (no saveCategories ) for a category group can permanently reorder or re-parent categories ...