CVE-2026-72785

Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission (without saveCategories) for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via the structures/move-element action. The structureEditable flag is computed from the view permission rather than the save permission, and the StructuresController authorizes the mutating action on that read-time session grant without a save re-check. Because a category's URI is derived from its position in the structure, moving a category changes its URL and those of its descendants and can corrupt navigation menus built from the category taxonomy. The issue is fixed in 5.10.6.

• CWE-863

• https://github.com/craftcms/cms/security/advisories/GHSA-xxpx-f366-4xpq
• https://www.vulncheck.com/advisories/craft-cms-before-authorization-bypass-via-structures-move-element

Published

Aug 11, 2026

Last Modified

Aug 28, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-72779Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.…4.5
• CVE-2026-72780Craft CMS before 5.10.5 fails to persist updated credential …6.5
• CVE-2026-72781Craft CMS versions >= 5.0.0-RC1 before 5.10.7 and >= 4.0.0-R…8.8
• CVE-2026-72782Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-R…6.5
• CVE-2026-72783Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-R…6.2
• CVE-2026-72784Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-R…5.4
• CVE-2026-72786Craft CMS versions before 5.10.8 contain an authentication b…6.5
• CVE-2026-72787Craft CMS versions before 5.10.8 contain a stored cross-site…6.4
• CVE-2026-72788SiYuan versions before v3.7.4 contain an information disclos…5.8
• CVE-2026-72789SiYuan before v3.7.4 fails to properly validate publish acce…8.6
• CVE-2026-7279AVACAST developed by eMPIA Technology, has a DLL Hijacking v…8.5
• CVE-2026-72790SiYuan before v3.7.4 contains an information disclosure vuln…5.8