Craft CMS allows a user with only view permissions to duplicate entries that belong to other users. The duplicate action bypasses the permission check that the interface shows, and an attacker can supply arbitrary entry IDs. Because entry IDs are sequential, an attacker can brute‑force many IDs to access or copy restricted content. The weakness is a classic IDOR/privilege escalation flaw (CWE‑639).

The vulnerability affects Craft CMS installations running any version earlier than 5.9.0‑beta.1 or 4.17.0‑beta.1. These include all releases 4.x and 5.x prior to the mentioned beta releases.

The CVSS score of 5.3 indicates a moderate severity. EPSS is below 1 %, suggesting low current exploitation probability, and the issue is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by sending a crafted HTTP request directly to the duplicate endpoint, optionally brute‑forcing entry IDs because they are incremental. Successful exploitation allows duplication of any entry the victim can view, exposing sensitive content across the system. The vulnerability requires no special user privileges beyond a view‑only role and no advanced skills, meaning a broad range of attackers could potentially target it.