CVE-2026-72785

Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission (without saveCategories) for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via the structures/move-element action. The structureEditable flag is computed from the view permission rather than the save permission, and the StructuresController authorizes the mutating action on that read-time session grant without a save re-check. Because a category's URI is derived from its position in the structure, moving a category changes its URL and those of its descendants and can corrupt navigation menus built from the category taxonomy. The issue is fixed in 5.10.6.

• CWE-863

• https://github.com/craftcms/cms/security/advisories/GHSA-xxpx-f366-4xpq
• https://www.vulncheck.com/advisories/craft-cms-before-authorization-bypass-via-structures-move-element

Published

Aug 11, 2026

Last Modified

Aug 11, 2026

Status

Received

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-72779Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.…8.7
• CVE-2026-72780Craft CMS before 5.10.5 fails to persist updated credential …7.1
• CVE-2026-72781Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-R…8.8
• CVE-2026-72782Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-R…7.1
• CVE-2026-72783Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-R…6.2
• CVE-2026-72784Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-R…6.9
• CVE-2026-7279AVACAST developed by eMPIA Technology, has a DLL Hijacking v…8.5
• CVE-2026-7280AVACAST developed by eMPIA Technology has a Unquoted Service…8.4
• CVE-2026-7281A vulnerability was determined in SourceCodester Pharmacy Sa…2.4
• CVE-2026-7282A vulnerability was identified in SourceCodester Pharmacy Sa…4.7
• CVE-2026-7283A security flaw has been discovered in SourceCodester Pharma…4.7
• CVE-2026-7284The Easy Elements for Elementor – Addons & Website Templates…9.8