Description

Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized sections by overwriting the sectionId attribute after initial authorization checks, bypassing the destination section permission validation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-02T12:17:15.670Z",
  "pubdate": "2026-09-02T12:17:15.670Z",
  "executiveSummary": "A broken access control vulnerability exists in Craft CMS versions prior to 5.10.11 within the element-indexes/save-elements endpoint.\nThe vulnerability allows authenticated control panel users with restricted permissions to manipulate the destination of entries by relocating them into sections for which they lack authorized access.\nBy leveraging this flaw, an attacker can bypass standard permission validation mechanisms to move or publish entries into unauthorized sections.\nThe primary risk involves unauthorized data relocation and potential privilege escalation regarding content management, as users can effectively circumvent section-level access restrictions enforced by the CMS.\nExploitation requires a valid, albeit limited, control panel session, allowing an attacker to modify the payload submitted to the vulnerable endpoint.",
  "technicalDetails": "The vulnerability resides within the element-indexes/save-elements endpoint, which is responsible for processing batch updates to element attributes, including organizational movements within the content architecture.\nThe root cause is an inadequate implementation of authorization checks that fails to validate the target destination parameters post-initial authorization.\nSpecifically, the application performs an authorization check to determine if the user has permission to initiate a move operation; however, it fails to re-validate that the specific destination section identifier (sectionId) supplied in the request is also within the scope of the user's authorized permissions.\nAn attacker can exploit this by intercepting the request sent to the element-indexes/save-elements endpoint and modifying the sectionId attribute in the request payload.\nBecause the server-side logic trusts the user-supplied sectionId after the initial, broad authorization check, it proceeds to reassign the entry to the unintended section.\nThis sequence effectively bypasses the expected integrity and access controls that should prevent unauthorized relocation of elements.\nThe attack flow follows these steps: 1) The attacker authenticates as a user with limited control panel access. 2) The attacker initiates an entry movement operation within the dashboard. 3) The attacker intercepts the HTTP request to the element-indexes/save-elements endpoint. 4) The attacker replaces the legitimate destination sectionId with an unauthorized identifier. 5) The server processes the request, updating the database record to move the entry to the restricted section, ignoring the user's lack of permissions for that specific section.\nThis vulnerability is present in all Craft CMS versions preceding 5.10.11. The scope of impact is limited to the control panel, requiring existing authenticated access, but provides a mechanism to violate the principle of least privilege regarding content administration."
}