A flaw in Craft CMS’s move‑to‑section endpoint allows a user who only holds general control‑panel access, but not the specific saveEntries permission for a section, to relocate any entry to any other section. The issue permits an authenticated attacker to reorder or reclassify content without proper authorization, potentially exposing sensitive materials or altering site structure. The weakness is a classic authorization bypass, reflected in CWE‑285 and CWE‑862.

Craft CMS versions from 5.3.0 through 5.9.13 are affected. The flaw is present in the core application, and the product affects all sites running the vulnerable releases. Patching to 5.9.14 or later resolves the issue.

The CVSS score of 4.9 places the vulnerability in the moderate range, while the EPSS score is under 1 % and the vulnerability is not currently listed in KEV. The exploit requires authentication and the ability to reach the control panel; the likely attack vector is an internal or compromised credential gaining access to the CMS admin interface.