CVE-2026-50281

Craft CMS is a content management system (CMS). Versions 5.7.0 and above, prior to 5.9.21 contain a mass-assignment flaw in the bulk-duplicate element action. An attacker who is only able to duplicate their own entires can submit an arbitrary id through the newAttributes request parameter. The duplication routine overrides its own id = null reset with that value and writes the attacker's attributes into the victim's existing entry row. ElementsController::beforeAction() pulls the request body into $this->_attributes and rejects requests that ship an id or canonicalId key at the top level, actionBulkDuplicate(), reads a separate newAttributes array and passes it straight through to the service layer. Elements::duplicateElement() clones the source element, sets id to null, and then hands the attacker's array to Craft::configure(), which overwrites the reset id with any numeric value inside $newAttributes. PHP Yii's saveElement() then performs an UPDATE against the row with that primary key instead of an INSERT. The attackers's title, slug, authorId, postDate, and UID land on the victim's entry. safeAttributes() on Entry includes id because the base element model exposes it, so the Collection::only() filter does not strip it. This issue has been fixed in version 5.9.21.

• CWE-915

• https://github.com/craftcms/cms/commit/8f6587c25050bbb6e080d59c71f6bb8932fc8600
• https://github.com/craftcms/cms/security/advisories/GHSA-x5m4-g2cq-52pq

Published

Jul 2, 2026

Last Modified

Jul 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50272dd-trace is the Datadog APM client for Node.js. Prior to 5.1…7.5
• CVE-2026-50273Datadog .NET Tracer is a client library for Datadog APM for …7.5
• CVE-2026-50274Datadog dd-trace-go is a Go client library for Datadog appli…7.5
• CVE-2026-50279Craft CMS is a content management system (CMS). IN versions …7.6
• CVE-2026-5028The Eight Day Week Print Workflow plugin for WordPress is vu…6.5
• CVE-2026-50280Craft CMS is a content management system (CMS). In versions …6
• CVE-2026-50282Craft CMS is a content management system (CMS). Versions 5.0…4.9
• CVE-2026-50283Craft CMS is a content management system (CMS). Versions 5.0…5.3
• CVE-2026-50284Craft CMS is a content management system (CMS). In versions …7.1
• CVE-2026-50287AgenticMail gives AI agents real email addresses and phone n…8.7
• CVE-2026-50289systeminformation is a System and OS information library for…8.8
• CVE-2026-5029A remote code execution vulnerability exists in Code Runner …8.7