Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 and above prior to 5.9.21, the EntriesController::actionMoveToSection() endpoint gates the destination section only by viewEntries:$section->uid rather than requiring saveEntries permission (the source entry is separately checked via Entry::canMove()). As a result, a low-privileged authenticated control-panel user who can move an entry out of its current section can call moveEntryToSection() to rewrite the entry's sectionId and save it into a section where they have read access but no write access. This breaks the section-level authorization model, letting a user with limited permissions inject content into a protected section and interfere with editorial boundaries, approval workflows, and section-specific business logic. This issue has been fixed in version 5.9.21.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-50280 Insufficient Authorization in Craft CMS EntriesController moveToSection Endpoint Versions 5.0.0-RC1 Through 5.9.20 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-50280
Post summary
The post reports CVE‑2026‑50280 as an insufficient authorization flaw in Craft CMS’s EntriesController moveToSection endpoint for versions 5.0.0‑RC1 to 5.9.20, with no PoC, exploit, or patch referenced.