CVE-2026-50279 Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
Low-privileged users can spoof entry authorship in Craft CMS by exploiting an authorization gap during entry saving, bypassing peer-author-change permissions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-50279?
CVE-2026-50279 is a high-severity missing authorization vulnerability in craftcms cms, published on 1 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Craft CMS is a content management system (CMS). IN versions 5.0.0-RC1 and above prior to 5.9.21, theEntriesController::actionSaveEntry() performs entry-edit permission checks before request-controlled author changes are applied to the model, allowing for authorship spoofing. The subsequent author mutation path accepts attacker-supplied authors / author parameters and allows the change when the current user is one of the old authors. Because the controller does not re-run authorization after mutating the author list, a low-privileged user can reassign an entry’s authorship to another user without holding the dedicated peer-author-change permission. This issue has been fixed in version 5.9.21.
Weakness: CWE-285
Which versions are affected by CVE-2026-50279?
2 open source packages ship an affected version, including craftcms/cms.
| Package | Affected | Fixed in |
|---|---|---|
craftcms/cms Packagist | From 5.0.0-RC1 | 5.9.21 |
craftcms/cms Packagist | From 5.0.0-RC1 | 5.9.21 |
How do I fix CVE-2026-50279?
Upgrade craftcms/cms to 5.9.21 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-50279 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-50279 exists.
Sources
Also known as GHSA-qq2c-2q8j-jh27.