CVE-2026-50280

The EntriesController::actionMoveToSection() endpoint checks only whether the current user can view the destination section, but it does not require permission to save entries into that section. A low-privileged authenticated control-panel user who can move an entry out of its current section can therefore move that entry into a different section where they have read access but no write access.

Details

The vulnerable route is implemented in EntriesController.php:465:

The destination check is only viewEntries:$section->uid . The source-entry gate is Entry::canMove(), which verifies whether the user can move the existing entry based on the source section:

This closes the exploit chain:

1. External source: authenticated CP request to entries/move-to-section.
2. Missing authorization check: destination section requires only viewEntries, not saveEntries.
3. Privileged sink: moveEntryToSection() rewrites sectionId and saves the entry into the unauthorized section.

Preconditions derived from the code:

1. The attacker is authenticated to the control panel.
2. Entry 345 is movable by the attacker from its current section.
3. The attacker can satisfy viewEntries on destination section 12.
4. The attacker does not have saveEntries:DESTINATION_UID, which is the missing check that makes the bypass possible.

Result:

1. The controller accepts the request because viewEntries:$section->uid passes.
2. Each source entry passes canMove() based on source-section permissions.
3. moveEntryToSection() updates the entry’s sectionId and saves it.
4. The entry is now located in a section where the attacker did not have write permission.

This breaks the intended section-level authorization model. A user with limited content permissions can inject or relocate content into a protected section, interfering with editorial boundaries, approval workflows, section-specific business logic, and content ownership expectations.

Kodem intelligence

1. What is CVE-2026-50280? CVE-2026-50280 is a medium-severity security vulnerability in craftcms/cms (composer), affecting versions >= 5.0.0-RC1, < 5.9.21. It is fixed in 5.9.21.
2. Which versions of craftcms/cms are affected by CVE-2026-50280? craftcms/cms (composer) versions >= 5.0.0-RC1, < 5.9.21 is affected.
3. Is there a fix for CVE-2026-50280? Yes. CVE-2026-50280 is fixed in 5.9.21. Upgrade to this version or later.
4. Is CVE-2026-50280 exploitable, and should I be worried? Whether CVE-2026-50280 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-50280 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-50280? Upgrade craftcms/cms to 5.9.21 or later.

Other vulnerabilities in craftcms/cms