GHSA-xxpx-f366-4xpq

Source

https://github.com/advisories/GHSA-xxpx-f366-4xpq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-xxpx-f366-4xpq/GHSA-xxpx-f366-4xpq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xxpx-f366-4xpq

Aliases

CVE-2026-72785

Published

2026-08-06T21:43:54Z

Modified

2026-09-01T21:30:06.863800612Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element

Details

A control-panel user who holds only the viewCategories permission for a category group (and not saveCategories) can permanently modify that group's category structure — reordering and re-parenting categories via the structures/move-element action.

A read-time authorization grant that a write endpoint later trusts. For categories, the structureEditable flag is computed from the view permission (src/elements/Category.php:205) instead of the save permission (entries correctly use saveEntries — src/elements/Entry.php:341). When the read-only category index renders, craft\base\Element::indexHtml() calls Craft::$app->getSession()->authorize('editStructure:<structureId>'); StructuresController then authorizes the structure-mutating action solely on that session grant, with no canSave re-check.

Verified on Craft CMS 5.10.5. Same class as the moderate-severity authorization bypasses fixed in 5.10.3 and 5.10.5; this is a distinct, unpatched instance.

Impact

A low-privileged, authenticated user (view-only on a category group) can persistently alter the sibling ordering and parent/child nesting of the category taxonomy. Because a category’s URI is derived from its position in the structure (ancestor slugs), moving a category changes its URL and the URLs of its descendants, and can corrupt any navigation/menus built from the category tree. This is an integrity/broken access-control issue: content that the user has no permission to modify is being modified. No confidentiality impact and no RCE; scope is content/taxonomy integrity.

Database specific

{
    "nvd_published_at": null,
    "github_reviewed_at": "2026-08-06T21:43:54Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-863"
    ]
}

References

Affected packages

Packagist / craftcms/cms

Package

Name: craftcms/cms
Purl: pkg:composer/craftcms/cms

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.0.0-RC1

Fixed

5.10.6

Affected versions

5.*

5.0.0-RC1

5.0.0

5.0.1

5.0.2

5.0.3

5.0.4

5.0.5

5.0.6

5.1.0

5.1.1

5.1.2

5.1.3

5.1.4

5.1.5

5.1.6

5.1.7

5.1.8

5.1.9

5.1.10

5.2.0-beta.1

5.2.0-beta.2

5.2.0-beta.3

5.2.0-beta.4

5.2.0-beta.5

5.2.0-beta.6

5.2.0

5.2.1

5.2.2

5.2.3

5.2.4

5.2.4.1

5.2.5

5.2.6

5.2.7

5.2.8

5.2.9

5.2.10

5.3.0-beta.1

5.3.0-beta.2

5.3.0

5.3.0.1

5.3.0.2

5.3.0.3

5.3.1

5.3.2

5.3.3

5.3.4

5.3.5

5.3.6

5.4.0

5.4.0.1

5.4.1

5.4.2

5.4.3

5.4.4

5.4.5

5.4.5.1

5.4.6

5.4.7

5.4.7.1

5.4.8

5.4.9

5.4.10

5.4.10.1

5.5.0

5.5.0.1

5.5.1

5.5.1.1

5.5.2

5.5.3

5.5.4

5.5.5

5.5.6

5.5.6.1

5.5.7

5.5.8

5.5.9

5.5.10

5.6.0

5.6.0.1

5.6.0.2

5.6.1

5.6.2

5.6.3

5.6.4

5.6.5

5.6.5.1

5.6.6

5.6.7

5.6.8

5.6.9

5.6.9.1

5.6.10

5.6.10.1

5.6.10.2

5.6.11

5.6.12

5.6.13

5.6.14

5.6.15

5.6.16

5.6.17

5.7.0-beta.1

5.7.0-beta.2

5.7.0

5.7.1

5.7.1.1

5.7.2

5.7.3

5.7.4

5.7.5

5.7.6

5.7.7

5.7.8

5.7.8.1

5.7.8.2

5.7.9

5.7.10

5.7.11

5.8.0

5.8.1

5.8.2

5.8.3

5.8.4

5.8.5

5.8.6

5.8.7

5.8.8

5.8.9

5.8.10

5.8.11

5.8.12

5.8.13

5.8.13.1

5.8.13.2

5.8.14

5.8.15

5.8.16

5.8.17

5.8.18

5.8.19

5.8.20

5.8.21

5.8.22

5.8.23

5.9.0-beta.1

5.9.0-beta.2

5.9.0

5.9.1

5.9.2

5.9.3

5.9.4

5.9.5

5.9.6

5.9.7

5.9.8

5.9.9

5.9.10

5.9.11

5.9.12

5.9.13

5.9.14

5.9.15

5.9.16

5.9.17

5.9.18

5.9.19

5.9.20

5.9.21

5.9.22

5.9.23

5.10.0

5.10.1

5.10.2

5.10.3

5.10.4

5.10.4.1

5.10.5

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-xxpx-f366-4xpq/GHSA-xxpx-f366-4xpq.json"