Craft Affected by Entries Authorship Spoofing via Mass Assignment

@@ -4,6 +4,7 @@
 
 - Fixed an error that could occur when loading elements with provisional changes.
 - Fixed a [moderate-severity](https://github.com/craftcms/cms/security/policy#severity--remediation) user account enumeration vulnerability.
+- Fixed a [moderate-severity](https://github.com/craftcms/cms/security/policy#severity--remediation) permission escalation vulnerability.
 
 ## 5.9.0-beta.1 - 2026-01-20
 

@@ -582,7 +582,7 @@ public function actionSaveElements(): Response
             if (!empty($attributes)) {
                 $scenario = $element->getScenario();
                 $element->setScenario(Element::SCENARIO_LIVE);
-                $element->setAttributes($attributes);
+                $element->setAttributesFromRequest($attributes);
                 $element->setScenario($scenario);
             }
 

@@ -14,6 +14,7 @@
 - The `@parseRefs` and `@transform` GraphQL directives are now optional for each GraphQL schema. (GHSA-7x43-mpfg-r9wj)
 
 ### Extensibility
+- Added `craft\base\ElementInterface::setAttributesFromRequest()`.
 - Added `craft\services\Search::deleteOrphanedIndexJobs()`.
 - Added `craft\web\GqlResponseFormatter`.
 - Added `craft\web\Response::FORMAT_GQL`.
@@ -37,4 +38,4 @@
 - Fixed a bug where Table fields with the “Static Rows” setting enabled would lose track of which values belonged to which row headings, if the “Default Values” table was reordered. ([#17090](https://github.com/craftcms/cms/issues/17090))
 - Fixed a bug where deadlocks could occur when updating elements’ search indexes. ([#18139](https://github.com/craftcms/cms/pull/18139))
 - Fixed an RCE vulnerability. (GHSA-v47q-jxvr-p68x)
-- Fixed a permission escalation vulnerability. (GHSA-jxm3-pmm2-9gf6)
+- Fixed permission escalation vulnerabilities. (GHSA-2xfc-g69j-x2mp, GHSA-jxm3-pmm2-9gf6)

@@ -1224,6 +1224,14 @@ public function isNextSiblingOf(self $element): bool;
      */
     public function offsetExists($offset): bool;
 
+    /**
+     * Sets the element’s attributes from an element editor submission.
+     *
+     * @param array $values The attribute values
+     * @since 4.17.0
+     */
+    public function setAttributesFromRequest(array $values): void;
+
     /**
      * Returns the status of a given attribute.
      *

@@ -4008,6 +4008,14 @@ public function offsetExists($offset): bool
         return $offset === 'title' || $this->hasEagerLoadedElements($offset) || parent::offsetExists($offset) || $this->fieldByHandle($offset);
     }
 
+    /**
+     * @inheritdoc
+     */
+    public function setAttributesFromRequest(array $values): void
+    {
+        $this->setAttributes($values);
+    }
+
     /**
      * @inheritdoc
      */

@@ -199,7 +199,7 @@ public function actionCreate(): Response
         if ($this->_siteId) {
             $element->siteId = $this->_siteId;
         }
-        $element->setAttributes($this->_attributes);
+        $element->setAttributesFromRequest($this->_attributes);
 
         $user = static::currentUser();
 
@@ -2113,7 +2113,7 @@ private function _applyParamsToElement(ElementInterface $element): void
 
         $scenario = $element->getScenario();
         $element->setScenario(Element::SCENARIO_LIVE);
-        $element->setAttributes($this->_attributes);
+        $element->setAttributesFromRequest($this->_attributes);
 
         if ($this->_slug !== null) {
             $element->slug = $this->_slug;

@@ -432,14 +432,14 @@ private function _getEntryModel(): Entry
     private function _populateEntryModel(Entry $entry): void
     {
         // Set the entry attributes, defaulting to the existing values for whatever is missing from the post data
-        $entry->typeId = $this->request->getBodyParam('typeId', $entry->typeId);
-        $entry->slug = $this->request->getBodyParam('slug', $entry->slug);
-        if (($postDate = $this->request->getBodyParam('postDate')) !== null) {
-            $entry->postDate = DateTimeHelper::toDateTime($postDate) ?: null;
-        }
-        if (($expiryDate = $this->request->getBodyParam('expiryDate')) !== null) {
-            $entry->expiryDate = DateTimeHelper::toDateTime($expiryDate) ?: null;
-        }
+        $entry->setAttributesFromRequest(array_filter([
+            'authorId' => $this->request->getBodyParam('author') ?? $entry->getAuthorId() ?? static::currentUser()->id,
+            'expiryDate' => $this->request->getBodyParam('expiryDate'),
+            'postDate' => $this->request->getBodyParam('postDate'),
+            'slug' => $this->request->getBodyParam('slug'),
+            'title' => $this->request->getBodyParam('title'),
+            'typeId' => $this->request->getBodyParam('typeId'),
+        ], fn($value) => $value !== null));
 
         $enabledForSite = $this->enabledForSiteValue();
         if (is_array($enabledForSite)) {
@@ -449,7 +449,6 @@ private function _populateEntryModel(Entry $entry): void
             $entry->enabled = (bool)$this->request->getBodyParam('enabled', $entry->enabled);
         }
         $entry->setEnabledForSite($enabledForSite ?? $entry->getEnabledForSite());
-        $entry->title = $this->request->getBodyParam('title', $entry->title);
 
         if (!$entry->typeId) {
             // Default to the section's first entry type
@@ -462,15 +461,6 @@ private function _populateEntryModel(Entry $entry): void
         $fieldsLocation = $this->request->getParam('fieldsLocation', 'fields');
         $entry->setFieldValuesFromRequest($fieldsLocation);
 
-        // Author
-        $authorId = $this->request->getBodyParam('author', ($entry->authorId ?: static::currentUser()->id));
-
-        if (is_array($authorId)) {
-            $authorId = $authorId[0] ?? null;
-        }
-
-        $entry->authorId = $authorId;
-
         // Parent
         if (($parentId = $this->request->getBodyParam('parentId')) !== null) {
             $entry->setParentId($parentId);

@@ -800,8 +800,10 @@ public function extraFields(): array
     public function attributeLabels(): array
     {
         return array_merge(parent::attributeLabels(), [
-            'postDate' => Craft::t('app', 'Post Date'),
+            'authorId' => Craft::t('app', 'Author'),
             'expiryDate' => Craft::t('app', 'Expiry Date'),
+            'postDate' => Craft::t('app', 'Post Date'),
+            'typeId' => Craft::t('app', 'Entry Type'),
         ]);
     }
 
@@ -812,6 +814,7 @@ protected function defineRules(): array
     {
         $rules = parent::defineRules();
         $rules[] = [['sectionId', 'typeId', 'authorId'], 'number', 'integerOnly' => true];
+        $rules[] = [['sectionId', 'typeId'], 'required'];
         $rules[] = [['postDate', 'expiryDate'], DateTimeValidator::class];
 
         $rules[] = [
@@ -825,17 +828,60 @@ protected function defineRules(): array
             'on' => self::SCENARIO_LIVE,
         ];
 
-        if ($this->sectionId) {
-            $section = $this->getSection();
+        $rules[] = [
+            ['authorId'],
+            'required',
+            'when' => fn() => $this->getSection()->type !== Section::TYPE_SINGLE,
+            'on' => self::SCENARIO_LIVE,
+        ];
 
-            if ($section->type !== Section::TYPE_SINGLE) {
-                $rules[] = [['authorId'], 'required', 'on' => self::SCENARIO_LIVE];
-            }
-        }
+        $rules[] = [
+            ['typeId'],
+            function($attribute) {
+                $typeId = $this->getTypeId();
+                foreach ($this->getAvailableEntryTypes() as $entryType) {
+                    if ($entryType->id === $typeId) {
+                        return;
+                    }
+                }
+                $this->addError($attribute, Craft::t('yii', '{attribute} is invalid.', [
+                    'attribute' => $this->getAttributeLabel($attribute),
+                ]));
+            },
+        ];
+
+        $rules[] = [
+            ['authorId'],
+            function($attribute) {
+                if (!$this->getAuthor()->can(sprintf("viewEntries:%s", $this->getSection()->uid))) {
+                    $this->addError($attribute, Craft::t('app', 'This user doesn’t have permission to author entries in this section.'));
+                }
+            },
+            'when' => fn() => $this->getSection()->type !== Section::TYPE_SINGLE,
+        ];
 
         return $rules;
     }
 
+    /**
+     * @inheritdoc
+     */
+    public function setAttributesFromRequest(array $values): void
+    {
+        $authorId = $this->normalizeAuthorId(ArrayHelper::remove($values, 'authorId'));
+
+        parent::setAttributesFromRequest($values);
+
+        // Only set the author if the user has permission to change it
+        if (
+            $authorId !== null &&
+            $authorId !== $this->getAuthorId() &&
+            Craft::$app->getUser()->checkPermission(sprintf('viewPeerEntries:%s', $this->getSection()->uid))
+        ) {
+            $this->setAuthorId($authorId);
+        }
+    }
+
     /**
      * @inheritdoc
      */
@@ -1229,17 +1275,17 @@ public function getAuthorId(): ?int
      */
     public function setAuthorId(array|int|string|null $authorId): void
     {
-        if ($authorId === '') {
-            $authorId = null;
-        }
+        $this->_authorId = $this->normalizeAuthorId($authorId);
+        $this->_author = null;
+    }
 
+    private function normalizeAuthorId(array|int|string|null $authorId): ?int
+    {
         if (is_array($authorId)) {
-            $this->_authorId = reset($authorId) ?: null;
-        } else {
-            $this->_authorId = $authorId;
+            $authorId = reset($authorId);
         }
 
-        $this->_author = null;
+        return $authorId ? (int)$authorId : null;
     }
 
     /**

@@ -1586,6 +1586,7 @@
     'This tab is conditional' => 'This tab is conditional',
     'This update requires PHP {v1}, but your composer.json file is currently set to PHP {v2}.' => 'This update requires PHP {v1}, but your composer.json file is currently set to PHP {v2}.',
     'This update requires PHP {v1}, but your environment is currently running PHP {v2}.' => 'This update requires PHP {v1}, but your environment is currently running PHP {v2}.',
+    'This user doesn’t have permission to author entries in this section.' => 'This user doesn’t have permission to author entries in this section.',
     'This week' => 'This week',
     'This year' => 'This year',
     'This {type} doesn’t have revisions.' => 'This {type} doesn’t have revisions.',