Improper Authorization

Craft CMS is vulnerable to Improper Authorization. The vulnerability is due to insufficient authorization checks after author reassignment in EntriesController::actionSaveEntry, where attacker-controlled author parameters are applied without revalidating permissions, allowing low-privileged users...

PT-2026-55425

Summary There is a mass-assignment flaw in the bulk-duplicate element action. Alice, holding only the permission to duplicate an entry she owns, submits an arbitrary id through the newAttributes request parameter. The duplication routine overrides its own id = null reset with that value and write...