Description
Craft CMS is a content management system (CMS). IN versions 5.0.0-RC1 and above prior to 5.9.21, theEntriesController::actionSaveEntry() performs entry-edit permission checks before request-controlled author changes are applied to the model, allowing for authorship spoofing. The subsequent author mutation path accepts attacker-supplied authors / author parameters and allows the change when the current user is one of the old authors. Because the controller does not re-run authorization after mutating the author list, a low-privileged user can reassign an entry’s authorship to another user without holding the dedicated peer-author-change permission. This issue has been fixed in version 5.9.21.
Published: 2026-07-01
Score: 7.6 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Craft CMS versions 5.0.0‑RC1 up to 5.9.20 contain an authorization bypass that allows a user with entry‑edit permission to change an entry’s author list after the initial permission check has passed, without possessing the dedicated peer‑author‑change privilege. This flaw, identified as CWE‑285, enables an attacker to reassign ownership of an entry to another user, effectively forging authorship.

Affected Systems

Craft CMS, versions 5.0.0‑RC1 to 5.9.20, all products listed under the craftcms:cms CNA designation.

Risk and Exploitability

The CVSS base score of 7.6 indicates a high severity vulnerability, while the EPSS score of <1% shows that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog, indicating it has not been broadly exploited. Attackers can target the /entries/save-entry endpoint by crafting a request that includes new author identifiers. The controller fails to re‑run authorization after mutating the author list, creating a clear attack path for users.

Generated by OpenCVE AI on July 21, 2026 at 12:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Craft CMS to version 5.9.21 or later, where the issue has been fixed.
  • Enforce the peer‑author‑change permission on all author modifications, ensuring the server validates the author list for every entry edit.
  • Restrict the /entries/save‑entry endpoint to authenticated sessions with proper edit rights and monitor system logs for anomalous author changes.

Generated by OpenCVE AI on July 21, 2026 at 12:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-qq2c-2q8j-jh27 Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
History

Fri, 03 Jul 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
Description Craft CMS is a content management system (CMS). IN versions 5.0.0-RC1 and above prior to 5.9.21, theEntriesController::actionSaveEntry() performs entry-edit permission checks before request-controlled author changes are applied to the model, allowing for authorship spoofing. The subsequent author mutation path accepts attacker-supplied authors / author parameters and allows the change when the current user is one of the old authors. Because the controller does not re-run authorization after mutating the author list, a low-privileged user can reassign an entry’s authorship to another user without holding the dedicated peer-author-change permission. This issue has been fixed in version 5.9.21.
Title Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap
Weaknesses CWE-285
References
Metrics cvssV4_0

{'score': 7.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-02T12:27:42.242Z

Reserved: 2026-06-04T16:26:05.985Z

Link: CVE-2026-50279

cve-icon Vulnrichment

Updated: 2026-07-02T12:27:39.071Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T12:45:02Z

Weaknesses