ECHO-8702-37AF-3BA1

Bulletin has no description...

ECHO-496E-C070-4EC0

Bulletin has no description...

MINI-J2X7-XGWF-2VQ5

Bulletin has no description...

MINI-V73P-H978-G6JJ

Bulletin has no description...

ECHO-1A7D-6048-6715

Bulletin has no description...

MINI-3G72-J5HH-656J

Bulletin has no description...

MINI-6JWF-CC6J-GMPJ

Bulletin has no description...

MINI-966C-36WJ-V9XR

Bulletin has no description...

MINI-4GGX-9FQW-8P2X

Bulletin has no description...

MINI-RP2X-RP64-5QMM

Bulletin has no description...

MINI-7552-GVRH-GV89

Bulletin has no description...

EUVD-2026-41215

Craft CMS: Authorization bypass in entries/move-to-section via missing target-section save check...

GHSA-43CQ-C2GQ-PFPW Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check

Summary The EntriesController::actionMoveToSection endpoint checks only whether the current user can view the destination section, but it does not require permission to save entries into that section. A low-privileged authenticated control-panel user who can move an entry out of its current secti...

EUVD-2026-41214

Craft CMS: Authorship spoofing in entries/save-entry via pre-check/post-mutation authorization gap...

GHSA-QQ2C-2Q8J-JH27 Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap

Summary EntriesController::actionSaveEntry performs entry-edit permission checks before request-controlled author changes are applied to the model. The subsequent author mutation path accepts attacker-supplied authors / author parameters and allows the change when the current user is one of the o...

Improper Authorization

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Improper Authorization in the entries/save-entry process. An attacker can reassign content authorship to another user without proper authorization by submitting crafted requests containing...

Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap

Summary EntriesController::actionSaveEntry performs entry-edit permission checks before request-controlled author changes are applied to the model. The subsequent author mutation path accepts attacker-supplied authors / author parameters and allows the change when the current user is one of the o...

MINI-XVV5-94X6-J446

Bulletin has no description...

MINI-JMQ8-JR32-F43Q

Bulletin has no description...

CVE-2026-50281

Craft CMS is a content management system CMS. Versions 5.7.0 and above, prior to 5.9.21 contain a mass-assignment flaw in the bulk-duplicate element action. An attacker who is only able to duplicate their own entires can submit an arbitrary id through the newAttributes request parameter. The...