Missing Authorization

Overview payload is a Node, React and MongoDB Headless CMS and Application Framework Affected versions of this package are vulnerable to Missing Authorization via the reorder endpoint in packages/payload/src/config/orderable/index.ts, where access control checks on update operations are...

CVE-2026-92589

Craft CMS versions 5.0.0 through 5.10.12 contain a broken access control flaw in the actions/nested-elements/reorder endpoint. Unlike the corresponding delete endpoint, this endpoint trusts the manageNestedElements::::field: session flag alone and never rechecks the caller's savePeerEntries permi...

GHSA-RQJW-R5G4-X8QM Duplicate Advisory: Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9p7c-v5x3-rfx8. This link is maintained to preserve external references. Original Description A vulnerability was detected in Craft CMS up to 4.18.0.1. Affected is the function actionReorderSets of the file...