Craft CMS's entry creation prior to version 4.17.0‑beta.1 and 5.9.0‑beta.1 processes the authorId parameter without verifying the current user's authorization. Users with Create Entries permission can inject authorId or authorIds[] into the request, enabling them to attribute new entries to any user, including administrators. This flaw results in unauthorized attribution of content and potential misuse of administrative identity, representing an integrity and trust loss in the system.

All installations of Craft CMS older than 4.17.0‑beta.1 in the 4.x series and older than 5.9.0‑beta.1 in the 5.x series are vulnerable. The affected products include Craft CMS 4.0.0 through 4.16.x and Craft CMS 5.0.0 through 5.8.x. Users should verify their version and apply the fix.

The vulnerability scores a CVSS base of 7.1, indicating a high impact if exploited. Exploitation is feasible through the standard entry creation endpoint by any authenticated user possessing the Create Entries permission. The likely attack vector is remote over HTTP, inferred from the fact that the vulnerability is exercised via a POST request to the entry creation endpoint. The probability of exploitation is very low (<1%), and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Because the attacker can impersonate any user, including an admin, the risk to organizational trust and content integrity remains significant.