Craft CMS versions 5.6.0 through 5.9.14 contain a missing authorization check that allows any authenticated user with the minimal viewUsers permission to submit an empty groups list to the actionSavePermissions endpoint, which removes all users from their groups. This oversight effectively lets an authorized user alter or remove the group memberships of any other user, potentially causing loss of privileges or disabling of user accounts. The flaw is an instance of an Authorization Bypass (CWE‑862).

The vulnerability affects Craft CMS, v5.6.0 to v5.9.14. A patch was released in version 5.9.15, so all installations running any version in that range are impacted.

The CVSS score of 5.3 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The flaw is exploitable only by users with at least viewUsers permission; an attacker would need to be authenticated and able to submit a crafted request to the save-permissions endpoint. Because the attack requires existing legitimate privileges, the risk is primarily internal. Upgrading to a fixed version distinguishes the environment from exposure.