CVE-2026-81912

Concrete CMS before 9.5.3 contains a Cross-Site Request Forgery (CSRF) flaw in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm() endpoint moved selected group tree nodes without validating an action token, allowing a state-changing group move to be processed agains...

EUVD-2026-76243

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an...

CVE-2026-81912 Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an...

PT-2026-90149

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.3 Description Cross-Site Request Forgery CSRF exists in the Move Multiple Groups feature. The endpoint 'dashboard/users/groups/bulkupdate/confirm' allows moving selected group tree nodes without validating an...

CVE-2026-81912: Cross-Site Request Forgery (CSRF)

Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery in the Move Multiple Groups feature. The dashboard/users/groups/bulkupdate/confirm endpoint moved the selected group tree nodes without validating an action token, so a state-changing group move could be processed for an...

CVE-2026-64838

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process...

CVE-2026-64838 ICEcoder through 8.1 Path Traversal via oldFileName Parameter

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process...

CVE-2026-64838: Improper Limitation of a Pathname to a Restricted Directory

ICEcoder versions through 8.1 fail to properly validate the oldFileName parameter in file move and rename operations, allowing authenticated users to relocate files from outside the document root. Attackers can use path traversal sequences in oldFileName to move files writable by the PHP process...

CVE-2026-86512 java-json-tools json-patch Copy Move Operations CopyOperation.java MoveOperation.apply access control

A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java of the component Copy Move Operations. The manipulation leads to improper access control...

PT-2026-86980

A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java of the component Copy Move Operations. The manipulation leads to improper access control...

CVE-2026-86512: Improper Access Control

A vulnerability was identified in java-json-tools json-patch up to 1.13. This affects the function CopyOperation.apply/MoveOperation.apply of the file src/main/java/com/github/fge/jsonpatch/CopyOperation.java of the component Copy Move Operations. The manipulation leads to improper access control...

EUVD-2026-60438

ApostropheCMS: Missing destination-parent authorization in page move allows a low-privileged editor to move and re-rank pages inside a restricted subtree...

GHSA-WR5R-WQP2-X4FH ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree

Summary ApostropheCMS enforces per-type authorization on pages: a page type may declare editRole / publishRole and the core @apostrophecms/archive-page does, so a project can have page-type subtrees that only higher-privileged roles are allowed to create or edit within. The move operation is...

ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree

Summary ApostropheCMS enforces per-type authorization on pages: a page type may declare editRole / publishRole and the core @apostrophecms/archive-page does, so a project can have page-type subtrees that only higher-privileged roles are allowed to create or edit within. The move operation is...

NPM: ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree

NPM: ApostropheCMS: Missing destination-parent authorization in page move allows a low-privileged editor to move and re-rank pages inside a restricted subtree vulnerability discovered by ? in WordPress Npm apostrophe versions = 4.31.0...

GO-2026-6308 Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id in code.vikunja.io/api

Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body taskid in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

GHSA-H6CX-GJXX-V25C Sulu: Media move/update authorization bypass (IDOR)

Impact A media move authorization bypass IDOR lets a backend user move a media out of a collection they have no access to. The media move endpoint resolves its permission check from the collection value in the request rather than from the media's real collection. MediaManager::move then reassigns...

EUVD-2026-68888

Sulu: Media move/update authorization bypass IDOR...

Sulu: Media move/update authorization bypass (IDOR)

Impact A media move authorization bypass IDOR lets a backend user move a media out of a collection they have no access to. The media move endpoint resolves its permission check from the collection value in the request rather than from the media's real collection. MediaManager::move then reassigns...

Incorrect Authorization

Overview sulu/sulu is a highly extensible open-source PHP content management system based on the Symfony framework. Affected versions of this package are vulnerable to Incorrect Authorization through the MediaManager::move process. An attacker can gain unauthorized access to restricted media by...