Craft CMS contains a mass-assignment flaw in its bulk‑duplicate element action. An authenticated user can submit an arbitrary numeric identifier through the newAttributes request parameter. The duplication routine, after resetting the new element’s id to null, replaces that value with the attacker’s supplied id, causing the system to update the row with that primary key instead of inserting a new entry. The attacker’s title, slug, authorId, postDate, and UID are therefore written into the victim’s entry model. Based on the description, it is inferred that the attacker may target any existing entry whose id they know, potentially compromising content integrity.

The vulnerability affects Craft CMS versions 5.7.0 through 5.9.20 inclusive, for installations that expose the bulk‑duplicate element action to authenticated users. The issue was fixed in version 5.9.21 and later.

The CVSS score of 7.1 indicates high severity, while the EPSS score of < 1% reflects a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog, which suggests no known active exploitation. The attack requires an authenticated user with access to the bulk‑duplicate feature, so exposure is limited to those roles; the impact is primarily to content integrity rather than system compromise.