CVE-2026-84792

Craft CMS versions before 5.10.11 are affected by a broken access control vulnerability in the element-indexes/save-elements endpoint. An attacker with control panel access and limited section permissions can overwrite the sectionId attribute after the initial authorization check, bypassing the d...