Medium severity4.3NVD Advisory· Published Sep 2, 2026· Updated Sep 2, 2026

CVE-2026-84792

Description

Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized sections by overwriting the sectionId attribute after initial authorization checks, bypassing the destination section permission validation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Craftcms/CMSllm-fuzzy
Range: <5.10.11
Craftcms/Craft CMSllm-fuzzy
Range: <5.10.11

Patches

Vulnerability mechanics

References

github.com/craftcms/cms/security/advisories/GHSA-ccpq-mw3m-wwg2nvd
www.vulncheck.com/advisories/craft-cms-before-5.10.11-broken-access-control-via-element-indexesnvd

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000