CVE-2026-79987

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...

CVE-2026-79987 Low-privilege RCE through element-search eager loading

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...

CVE-2026-79987 Low-privilege RCE through element-search eager loading

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...

CVE-2026-79987

CVE-2026-79987 is a low-privilege remote code execution vulnerability in Craft CMS , exploitable by a remote, authenticated, non-admin Control Panel user holding only the accessCp permission. The root cause involves element-search eager loading , allowing the attacker to execute operating system ...

EUVD-2026-75586

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...

CVE-2026-79987: Use of Externally-Controlled Input to Select Classes or Code

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...

PT-2026-89486

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...

CVE-2026-33162: Improper Authorization

Craft CMS is a content management system CMS. From version 5.3.0 to before version 5.9.14, an authenticated control panel user with only accessCp can move entries across sections via POST /actions/entries/move-to-section, even when they do not have saveEntries:sectionUid permission for either...