10712 matches found
ECHO-8702-37AF-3BA1
Bulletin has no description...
MINI-J2X7-XGWF-2VQ5
Bulletin has no description...
MINI-V73P-H978-G6JJ
Bulletin has no description...
ECHO-1A7D-6048-6715
Bulletin has no description...
MINI-3G72-J5HH-656J
Bulletin has no description...
MINI-6JWF-CC6J-GMPJ
Bulletin has no description...
MINI-966C-36WJ-V9XR
Bulletin has no description...
MINI-4GGX-9FQW-8P2X
Bulletin has no description...
MINI-RP2X-RP64-5QMM
Bulletin has no description...
MINI-7552-GVRH-GV89
Bulletin has no description...
Access Control Bypass
Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Access Control Bypass via the entries/move-to-section process. An attacker can relocate entries into unauthorized sections by exploiting insufficient permission checks, allowing them to bypas...
Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check
Summary The EntriesController::actionMoveToSection endpoint checks only whether the current user can view the destination section, but it does not require permission to save entries into that section. A low-privileged authenticated control-panel user who can move an entry out of its current secti...
GHSA-43CQ-C2GQ-PFPW Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check
Summary The EntriesController::actionMoveToSection endpoint checks only whether the current user can view the destination section, but it does not require permission to save entries into that section. A low-privileged authenticated control-panel user who can move an entry out of its current secti...
EUVD-2026-41215
Craft CMS: Authorization bypass in entries/move-to-section via missing target-section save check...
EUVD-2026-41214
Craft CMS: Authorship spoofing in entries/save-entry via pre-check/post-mutation authorization gap...
Improper Authorization
Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Improper Authorization in the entries/save-entry process. An attacker can reassign content authorship to another user without proper authorization by submitting crafted requests containing...
Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
Summary EntriesController::actionSaveEntry performs entry-edit permission checks before request-controlled author changes are applied to the model. The subsequent author mutation path accepts attacker-supplied authors / author parameters and allows the change when the current user is one of the o...
GHSA-QQ2C-2Q8J-JH27 Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
Summary EntriesController::actionSaveEntry performs entry-edit permission checks before request-controlled author changes are applied to the model. The subsequent author mutation path accepts attacker-supplied authors / author parameters and allows the change when the current user is one of the o...