CVE-2026-72785 Craft CMS before 5.10.6 Authorization Bypass via structures/move-element
A user with view-only permissions can modify category structures in Craft CMS, altering URLs and navigation menus.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72785?
CVE-2026-72785 is a critical missing authorization vulnerability in craftcms cms, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission (without saveCategories) for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via the structures/move-element action. The structureEditable flag is computed from the view permission rather than the save permission, and the StructuresController authorizes the mutating action on that read-time session grant without a save re-check. Because a category's URI is derived from its position in the structure, moving a category changes its URL and those of its descendants and can corrupt navigation menus built from the category taxonomy. The issue is fixed in 5.10.6.
Weakness: CWE-863
Which versions are affected by CVE-2026-72785?
2 open source packages ship an affected version, including craftcms/cms.
| Package | Affected | Fixed in |
|---|---|---|
craftcms/cms Packagist | From 5.0.0-RC1 | 5.10.6 |
craftcms/cms Packagist | From 5.0.0-RC1 | 5.10.6 |
How do I fix CVE-2026-72785?
Upgrade craftcms/cms to 5.10.6 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-72785 being exploited?
There is no known exploitation of CVE-2026-72785 in the wild and no public exploit code.
Sources
Also known as GHSA-xxpx-f366-4xpq.