10 matches found
CVE-2026-84792: Missing Authorization
Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized...
Access Control Bypass
Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Access Control Bypass via the entries/move-to-section process. An attacker can relocate entries into unauthorized sections by exploiting insufficient permission checks, allowing them to bypas...
GHSA-43CQ-C2GQ-PFPW Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check
Summary The EntriesController::actionMoveToSection endpoint checks only whether the current user can view the destination section, but it does not require permission to save entries into that section. A low-privileged authenticated control-panel user who can move an entry out of its current secti...
PT-2026-51232
Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.17.7 Craft CMS versions 5.0.0-RC1 through 5.9.13 Description A missing authorization issue exists in the 'assets/preview-thumb' endpoint. A Control Panel user lacking permissions to view a specific privat...
Craft Commerce hasVariant/hasProduct Blind SQL Injection
Overview Craft Commerce’s ProductQuery::hasVariant and VariantQuery::hasProduct properties bypass the unset blocklist added to ElementIndexesController in GHSA-2453-mppf-46cj. The blocklist only strips top-level Yii2 Query properties where, orderBy, etc., but hasVariant and hasProduct pass throug...
Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions
Summary An authenticated control panel user with only accessCp can move entries across sections via POST /actions/entries/move-to-section, even when they do not have saveEntries:sectionUid permission for either source or destination section. Details Root-cause analysis 1. actionMoveToSection...
CVE-2023-22953
In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user...
CVE-2023-22953: Undefined Security Weakness
In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user...
PT-2023-18795 · Ellislab · Expressionengine
Name of the Vulnerable Software and Affected Versions: ExpressionEngine versions prior to 7.2.6 Description: The issue allows remote code execution by an authenticated Control Panel user. Recommendations: For versions prior to 7.2.6, update to version 7.2.6 or later to resolve the issue...
