The vulnerability in Craft CMS version 5.9.5 and earlier is a Missing Authorization flaw that affects the migrate endpoint (/actions/app/migrate). An attacker can issue requests to this endpoint without having sufficient privileges. The endpoint may execute migration logic or alter application state, enabling unauthorized data manipulation or other privileged actions. The flaw is classified under CWE-284.

This issue affects the Craft CMS content management system, specifically versions 5.9.5 and earlier. Users of these versions should verify their installed releases and consider updating to a supported release that does not expose the vulnerable endpoint.

The exploitability of this vulnerability is not quantitatively measured at present – EPSS is unavailable and the flaw is not listed in the CISA KEV catalog. However, because the attack vector is likely a direct HTTP request to a publicly accessible endpoint, an unauthenticated attacker could potentially exploit the missing authorization check. Without a published CVSS score, the exact risk level is uncertain, but the potential for unauthorized privilege escalation or data modification warrants prompt attention.