The vulnerability is a mass‑assignment flaw in Craft CMS’s bulk‑duplicate element action that allows an authenticated attacker to supply an arbitrary numeric id via the newAttributes request parameter. The duplication routine resets its own id to null but then merges the attacker’s array, overwriting the id in the configuration step and causing the system to perform an UPDATE against the existing entry instead of an INSERT. This results in the attacker’s title, slug, authorId, postDate, the victim’s entry row, thereby compromising content integrity.

The flaw impacts Craft CMS versions .7.0 and above, up to but not including 5.9.21, for installations that expose the bulk‑duplicate element action to authenticated users. It has been fixed in version 5.9.21 and later.

The CVSS score of 7.1 indicates high severity, while the EPSS score of < 1% reflects a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog, indicating no known active exploitation. The attack requires an authenticated user who can access the bulk‑duplicate action on their own entries; the flaw then allows that user to overwrite arbitrary existing entries by supplying a target id, potentially subverting content integrity.