medium

CVE-2026-50280

Packagist · craftcms/cms

Summary

Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check

Severity
medium
EPSS
0.4% (p34)
CWE
CWE-284
Also known as
GHSA-43cq-c2gq-pfpw
Published
2026-07-02
Updated
2026-07-02

Advisory details

Summary

The EntriesController::actionMoveToSection() endpoint checks only whether the current user can view the destination section, but it does not require permission to save entries into that section. A low-privileged authenticated control-panel user who can move an entry out of its current section can therefore move that entry into a different section where they have read access but no write access.

Details

The vulnerable route is implemented in EntriesController.php:465:

The destination check is only viewEntries:$section->uid . The source-entry gate is Entry::canMove(), which verifies whether the user can move the existing entry based on the source section:

This closes the exploit chain:

  1. External source: authenticated CP request to entries/move-to-section.
  2. Missing authorization check: destination section requires only viewEntries, not saveEntries.
  3. Privileged sink: moveEntryToSection() rewrites sectionId and saves the entry into the unauthorized section.

Preconditions derived from the code:

  1. The attacker is authenticated to the control panel.
  2. Entry 345 is movable by the attacker from its current section.
  3. The attacker can satisfy viewEntries on destination section 12.
  4. The attacker does not have saveEntries:DESTINATION_UID, which is the missing check that makes the bypass possible.

Result:

  1. The controller accepts the request because viewEntries:$section->uid passes.
  2. Each source entry passes canMove() based on source-section permissions.
  3. moveEntryToSection() updates the entry’s sectionId and saves it.
  4. The entry is now located in a section where the attacker did not have write permission.

Impact

This breaks the intended section-level authorization model. A user with limited content permissions can inject or relocate content into a protected section, interfering with editorial boundaries, approval workflows, section-specific business logic, and content ownership expectations.

References

Related advisories

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPTClaudePerplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.