CVE-2026-92589

Craft CMS versions 5.0.0 through 5.10.12 contain a broken access control flaw in the actions/nested-elements/reorder endpoint. Unlike the corresponding delete endpoint, this endpoint trusts the manageNestedElements::::field: session flag alone and never rechecks the caller's savePeerEntries permi...

GHSA-RQJW-R5G4-X8QM Duplicate Advisory: Craft CMS: Missing authorization check allows non-admin control panel users to reorder Global Sets

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9p7c-v5x3-rfx8. This link is maintained to preserve external references. Original Description A vulnerability was detected in Craft CMS up to 4.18.0.1. Affected is the function actionReorderSets of the file...