Auth bypass in Craftcms Cms
CVE-2026-28781
Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the entry creation process allows for Mass Assignment of the authorId attribute. A user with "Create Entries" permission can inject the authorIds[] (or authorId) parameter into the POST request, which the backend processes without verifying if the current user is authorized to assign authorship to others. Normally, this field is not present in the request for users without the necessary permissions. By manually adding this parameter, an attacker can attribute the new entry to any user, including Admins. This effectively "spoofs" the authorship. This vulnerability is fixed in 4.17.0-beta.1 and 5.9.0-beta.1.
Vulnerability class: IDOR (Insecure Direct Object Reference)
EPSS: 0.003 (25.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.
Affected products
- Craftcms Cms — versions >= 5.0.0-RC1, < 5.9.0-beta.1, >= 4.0.0-RC1, < 4.17.0-beta.1
- Craftcms Craft_cms — versions 4.0.0, 5.0.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Patch, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2026-28781?
- CVE-2026-28781 is a medium-severity vulnerability in Craftcms Cms, classified under Authorization Bypass Through User-Controlled Key. CVSS score: 6.5/10. Published 2026-03-04.
- How severe is CVE-2026-28781?
- Medium severity. CVSS v3 base score is 6.5 out of 10.