CVE-2026-84792CWE-862broken-access-control

CVE-2026-84792

Medium · published September 2, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
20.9
In the wild
Unconfirmed
What it is

Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized sections by overwriting the sectionId attribute after initial authorization checks, bypassing the destination section permission validation.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00295 · 20.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-02T16:17Z
References (2)
https://github.com/craftcms/cms/security/advisories/GHSA-ccpq-mw3m-wwg2 · [email protected]https://www.vulncheck.com/advisories/craft-cms-before-5.10.11-broken-access-control-via-element-indexes · [email protected]
EPSS history
Timeline
  • 04 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 02 SEP 11:11Z
    Craft CMS before 5.10.11 Broken Access Control via element-indexes
    cvelistv5