{"answers":{"affected":"2 open source packages ship an affected version, including craftcms/cms.","exploited":"There is no known exploitation of CVE-2026-72785 in the wild and no public exploit code.","fix":"Upgrade craftcms/cms to 5.10.6 or later.","what":"CVE-2026-72785 is a critical missing authorization vulnerability in craftcms cms, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-72785 and fix it if it is affected.\n\nWhat it is: CVE-2026-72785 is a critical missing authorization vulnerability in craftcms cms, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-72785 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- craftcms/cms (Packagist): affected from 5.0.0-RC1; fixed in 5.10.6\n- craftcms/cms (Packagist): affected from 5.0.0-RC1; fixed in 5.10.6\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-72785/ (Markdown: https://insights.sbomify.com/CVE-2026-72785/index.md)","id":"CVE-2026-72785","markdown":"https://insights.sbomify.com/CVE-2026-72785/index.md","name":"CVE-2026-72785","record":{"aliases":["GHSA-xxpx-f366-4xpq"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"Craft CMS","requires_auth":"none","summary":"A user with view-only permissions can modify category structures in Craft CMS, altering URLs and navigation menus.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"VulnCheck","cpe":[],"cvss":{"score":9.3,"severity":"critical","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"description":"Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission (without saveCategories) for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via the structures/move-element action. The structureEditable flag is computed from the view permission rather than the save permission, and the StructuresController authorizes the mutating action on that read-time session grant without a save re-check. Because a category's URI is derived from its position in the structure, moving a category changes its URL and those of its descendants and can corrupt navigation menus built from the category taxonomy. The issue is fixed in 5.10.6.","ecosystems":["Packagist"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Craft CMS before 5.10.6 Authorization Bypass via structures/move-element","id":"CVE-2026-72785","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":2,"n_references":2,"next":{"headline":"Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset","id":"CVE-2026-72786"},"packages":[{"ecosystem":"Packagist","fixed":["5.10.6"],"introduced":["5.0.0-RC1"],"last_affected":[],"package":"craftcms/cms","purl":null,"source":"GHSA-xxpx-f366-4xpq"},{"ecosystem":"Packagist","fixed":["5.10.6"],"introduced":["5.0.0-RC1"],"last_affected":[],"package":"craftcms/cms","purl":"pkg:composer/craftcms/cms","source":"GHSA-xxpx-f366-4xpq"}],"prev":{"headline":"Craft CMS 5.0.0-RC1 before 5.10.6 SSRF via GraphQL asset mutation","id":"CVE-2026-72784"},"products":["cms"],"published":"2026-08-11","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-08","vendors":["craftcms"]},"summary":"A user with view-only permissions can modify category structures in Craft CMS, altering URLs and navigation menus.","url":"https://insights.sbomify.com/CVE-2026-72785/"}