CVE-2026-50280 Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check
Low-privileged users can move entries into protected sections they cannot write to, bypassing section-level authorization controls in Craft CMS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-50280?
CVE-2026-50280 is a medium-severity missing authorization vulnerability in craftcms cms, published on 1 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 and above prior to 5.9.21, the EntriesController::actionMoveToSection() endpoint gates the destination section only by viewEntries:$section->uid rather than requiring saveEntries permission (the source entry is separately checked via Entry::canMove()). As a result, a low-privileged authenticated control-panel user who can move an entry out of its current section can call moveEntryToSection() to rewrite the entry's sectionId and save it into a section where they have read access but no write access. This breaks the section-level authorization model, letting a user with limited permissions inject content into a protected section and interfere with editorial boundaries, approval workflows, and section-specific business logic. This issue has been fixed in version 5.9.21.
Weakness: CWE-284
Which versions are affected by CVE-2026-50280?
2 open source packages ship an affected version, including craftcms/cms.
| Package | Affected | Fixed in |
|---|---|---|
craftcms/cms Packagist | From 5.0.0-RC1 | 5.9.21 |
craftcms/cms Packagist | From 5.0.0-RC1 | 5.9.21 |
How do I fix CVE-2026-50280?
Upgrade craftcms/cms to 5.9.21 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-50280 being exploited?
There is no known exploitation of CVE-2026-50280 in the wild and no public exploit code.
Sources
Also known as GHSA-43cq-c2gq-pfpw.