Craft CMS: Three High-Severity RCE and Command Execution Flaws Disclosed Together
Key findings • Three High (8.8) and one Medium (6.5) severity CVEs disclosed for Craft CMS between Sep 8-10, 2026. • Authenticated users can achieve RCE via element-index or OS command execut…
Key findings
- Three High (8.8) and one Medium (6.5) severity CVEs disclosed for Craft CMS between Sep 8-10, 2026.
- Authenticated users can achieve RCE via element-index or OS command execution via control panel permissions.
- Vulnerabilities CVE-2026-86732 and CVE-2026-86730 patched in Craft CMS 5.10.12.
- CVE-2026-79987 allows OS command execution by non-admin users with 'accessCp' permission.
- CVE-2026-86731 affects versions 5.0.0-RC1 through 5.10.11 due to a missing admin-target guard.
On September 8-10, 2026, a batch of four vulnerabilities was disclosed for Craft CMS, with three rated as High severity (CVSSv3 8.8) and one as Medium (CVSSv3 6.5). These vulnerabilities collectively expose authenticated users to risks ranging from operating system command execution to arbitrary class instantiation and object injection. The disclosures highlight potential weaknesses in how Craft CMS handles user permissions, element indexing, and field-layout data.
Two of the high-severity vulnerabilities, CVE-2026-86732 and CVE-2026-86730, were disclosed on September 8th and affect versions prior to 5.10.12. CVE-2026-86732 involves a remote code execution flaw in the element-index endpoint, allowing authenticated content editors to instantiate arbitrary classes via the criteria parameter. Similarly, CVE-2026-86730 permits authenticated control panel users to inject Yii2 behavior attachments and event handlers by failing to properly cleanse string-typed field-layout elements. Attackers can exploit this by posting field-layout tab elements as JSON strings to bypass validation and trigger arbitrary object instantiation.
Another high-severity vulnerability, CVE-2026-79987, disclosed on September 10th, allows a remote, authenticated, non-admin user with only the accessCp permission to execute operating system commands as the PHP web worker. This underscores a critical permission misconfiguration that can lead to command execution.
The medium-severity vulnerability, CVE-2026-86731, also disclosed on September 8th, affects Craft CMS versions 5.0.0-RC1 through 5.10.11. It stems from a missing admin-target guard in the UsersController::actionActivateUser action. Although the action requires administrateUsers permission, it fails to call requireAdmin() when the targeted user is an administrator, unlike its counterpart action. This could potentially allow for unauthorized administrative actions on administrator accounts.
The patched versions for CVE-2026-86732 and CVE-2026-86730 are 5.10.12 and later. The affected versions for CVE-2026-86731 are 5.0.0-RC1 through 5.10.11. Users are strongly advised to update their Craft CMS installations to the latest available versions to mitigate these security risks. The timely disclosure and patching of these vulnerabilities are crucial for maintaining the security posture of Craft CMS websites.
This batch of vulnerabilities, particularly the high-severity ones, emphasizes the importance of rigorous permission checks and secure data handling in web applications. The ability for authenticated users, even those with limited privileges, to execute arbitrary code or commands presents a significant risk to the integrity and confidentiality of websites built on Craft CMS. Administrators should remain vigilant and ensure their systems are updated promptly following security advisories. The span of disclosure over two days suggests a coordinated release of findings, underscoring the need for prompt attention from the Craft CMS community.