CVE-2026-92592

Craft CMS 4.8.0–4.18.5 and 5.0.0–5.10.12 are affected by a remote code execution vulnerability (CVSS 3.1 score 8.8 High ). The root cause is that the HMAC signature for the license-shun cookie is not bound to its purpose—Yii's cookieValidationKey derives from the same Craft securityKey used for s...

CVE-2026-92592 Craft CMS before 4.18.6 Remote Code Execution via signed cookie

Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bound to its purpose Yii's cookieValidationKey is derived from...

CVE-2026-92592 Craft CMS before 4.18.6 Remote Code Execution via signed cookie

Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bound to its purpose Yii's cookieValidationKey is derived from...

CVE-2026-92591 Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer

Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed production site whenever PHP remains available but the configured MySQL endpoint does...

CVE-2026-92592 Craft CMS before 4.18.6 Remote Code Execution via signed cookie

Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bound to its purpose Yii's cookieValidationKey is derived from...

CVE-2026-92590 Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields

Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticate...

CVE-2026-92590 Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields

Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticate...

CVE-2026-92590

Craft CMS versions 5.7.0 through 5.10.12 are affected by a stored cross-site scripting (XSS) vulnerability in the Generated Fields feature. The root cause is the disabling of Twig autoescaping combined with a failure to encode cached values , allowing content editors to inject malicious JavaScrip...

CVE-2026-92590 Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields

Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticate...

CVE-2026-92589 Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder

Craft CMS 5.0.0 through 5.10.12 fixed in 5.10.13 contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries but without savePeerEntries opens another author's entry in read-only mode, Craft...

CVE-2026-92589

Craft CMS versions 5.0.0 through 5.10.12 contain a broken access control flaw in the actions/nested-elements/reorder endpoint. Unlike the corresponding delete endpoint, this endpoint trusts the manageNestedElements::::field: session flag alone and never rechecks the caller's savePeerEntries permi...

CVE-2026-92589 Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder

Craft CMS 5.0.0 through 5.10.12 fixed in 5.10.13 contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries but without savePeerEntries opens another author's entry in read-only mode, Craft...

CVE-2026-92589 Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder

Craft CMS 5.0.0 through 5.10.12 fixed in 5.10.13 contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries but without savePeerEntries opens another author's entry in read-only mode, Craft...

CVE-2026-92590: Improper Neutralization of Input During Web Page Generation

Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticate...

CVE-2026-92591: Not Failing Securely

Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed production site whenever PHP remains available but the configured MySQL endpoint does...

CVE-2026-92593: Improper Control of Generation of Code

Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl - View::renderObjectTemplate sink remained unsandboxed, and the same fix commit added a self-signing oracle in Cp::elementLabelHtml. Because Craft/Yii HMAC tokens are not...

PT-2026-94106

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0 through 5.10.12 Description A broken access control flaw exists in the 'actions/nested-elements/reorder' endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries permissions but lacking...

PT-2026-94109

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.8.0 through 4.18.5 Craft CMS versions 5.0.0 through 5.10.12 Description An issue exists where the software signs an authenticated user's attacker-controlled license-shun cookie using the same key and format used to validat...

PT-2026-94107

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.7.0 through 5.10.12 Description A stored cross-site scripting issue exists in the Generated Fields feature. The flaw occurs because Twig autoescaping is disabled and cached values are not encoded. This allows content edito...

CVE-2026-92592: Improper Neutralization of Special Elements Used in a Template Engine

Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bound to its purpose Yii's cookieValidationKey is derived from...