CyberRota Analysis
AI-GeneratedCraft CMS versions prior to 5.10.11 are vulnerable to a broken access control issue that allows users with limited permissions to move entries into unauthorized sections via the element-indexes/save-elements endpoint. This vulnerability can lead to unauthorized content manipulation and publishing, posing a risk to the integrity of the content management system. Organizations using affected versions should prioritize patching to mitigate potential exploitation by malicious users.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized sections by overwriting the sectionId attribute after initial authorization checks, bypassing the destination section permission validation.