CVE-2026-28781: 
PHP vulnerability analysis and mitigation

CVE-2026-28781 is a mass assignment vulnerability in Craft CMS that allows authenticated users with "Create Entries" permission to spoof entry authorship by injecting the authorId or authorIds[] parameter into POST requests during entry creation. The backend fails to verify whether the requesting user is authorized to assign authorship to other accounts, enabling attribution of content to any user including administrators. Affected versions include Craft CMS 4.0.0-RC1 through 4.16.x and 5.0.0-RC1 through 5.8.x. It was disclosed on March 2, 2026, with a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory).

The root cause is classified under CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes). The vulnerability exists because the entry creation and editing controllers (EntriesController.php, ElementsController.php) called setAttributes() directly on the element model without restricting which attributes could be set from user-supplied request data. An attacker intercepts the entry save POST request and manually appends &authorIds[]=<victim_user_id> to the request body; the backend processes this parameter without checking if the current user has permission to assign authorship to others. The fix introduced a new setAttributesFromRequest() method on the Entry model that explicitly checks whether the current user holds the viewPeerEntries:<sectionUid> permission before allowing the authorId attribute to be changed (GitHub Advisory, Commit c6dcbdf, Commit 830b403).

Successful exploitation allows an attacker to falsely attribute newly created entries to any user in the system, including administrators, corrupting authorship records and audit trails. This can be used to frame administrators or other trusted users for content they did not create — including malicious, inappropriate, or policy-violating content — potentially bypassing editorial review processes that rely on author identity. There is no direct confidentiality or availability impact; the harm is entirely to data integrity and accountability mechanisms (GitHub Advisory).

Proof-of-concept exploit steps are publicly documented in the GitHub Security Advisory, making exploitation straightforward for any user with a "Create Entries" permission and knowledge of a target user's account ID. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.038% (16th percentile), indicating a low current probability of exploitation in the wild (GitHub Advisory).

1. Obtain a valid account: Acquire or use an existing Craft CMS account that has "Create Entries" permission for at least one section.
2. Identify the victim's user ID: Determine the target user's account ID (e.g., 1 for the default admin account, which is predictable in default installations).
3. Initiate entry creation: Log in and navigate to the Entries section, click "New Entry," and fill in the required fields.
4. Intercept the save request: Enable an HTTP proxy tool such as Burp Suite to intercept the POST request sent when clicking "Save."
5. Inject the authorId parameter: In the intercepted request body, append the parameter &authorIds[]=<victim_user_id> (e.g., &authorIds[]=1) and forward the modified request.
6. Verify authorship spoofing: Log in as the victim user (or as an admin) and navigate to Entries — the newly created entry will appear attributed to the victim account rather than the actual creator (GitHub Advisory).

• Network/Logs: HTTP POST requests to Craft CMS entry creation or save endpoints (e.g., /actions/entries/save-entry, /actions/elements/save) containing the parameters authorIds[] or authorId in the request body for users who do not normally have author-assignment permissions.
• Application Logs: Craft CMS application logs showing entries created by low-privileged users but attributed to administrator or other high-privileged user account IDs.
• Content Audit: Entries in the CMS database where the authorId field does not match the user session that created the entry, detectable by cross-referencing entry creation timestamps with session/access logs.
• Behavioral: Unusual pattern of entries attributed to administrator accounts created during sessions authenticated as non-admin users (GitHub Advisory).

Upgrade Craft CMS to version 4.17.0-beta.1 or later (for the 4.x branch) or 5.9.0-beta.1 or later (for the 5.x branch), which introduce the setAttributesFromRequest() method that enforces permission checks before allowing authorId to be modified from request data. If immediate patching is not possible, restrict "Create Entries" permissions to only fully trusted users and implement request logging or a WAF rule to detect and alert on POST requests to entry-save endpoints that include authorId or authorIds[] parameters from non-admin sessions (GitHub Advisory, Commit c6dcbdf).