CVE-2026-28782: 
PHP vulnerability analysis and mitigation

CVE-2026-28782 is a Permission Bypass and Insecure Direct Object Reference (IDOR) vulnerability in the "Duplicate" entry action of Craft CMS, classified as Moderate severity. It affects Craft CMS versions >= 4.0.0-RC1 and < 4.17.0-beta.1, and >= 5.0.0-RC1 and < 5.9.0-beta.1. The vulnerability was published on March 2, 2026, and patched versions were released the same day. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the Duplicate element action in src/elements/actions/Duplicate.php did not invoke a canDuplicate() permission check before processing the action, allowing any authenticated user to trigger it regardless of their assigned permissions. The attack vector is network-based and requires only low privileges — specifically, a valid session with "View Entries" permission on any section. An attacker bypasses the UI-level restriction by sending a direct POST request to /index.php?p=admin/actions/element-indexes/perform-action with a crafted JSON payload specifying arbitrary elementIds. Because Entry IDs are sequential integers, an attacker can trivially enumerate them via brute force to duplicate entries belonging to other users or restricted sections, with the duplicate being created under the attacker's ownership (GitHub Advisory, Craft CMS Commit).

Successful exploitation allows a low-privilege authenticated user to duplicate restricted entries they are not authorized to access, effectively reading the content of those entries by becoming the owner of the duplicate. This results in unauthorized disclosure of potentially sensitive or confidential content stored in Craft CMS entries across the system. While direct confidentiality impact is indirect (via duplication rather than direct read), integrity is affected as unauthorized copies of entries are created. There is no direct availability impact, and lateral movement beyond the CMS application is not facilitated by this vulnerability alone (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, including a ready-to-use curl command demonstrating the attack (GitHub Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.038% (13th percentile), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Obtain a low-privilege account: Log in to the target Craft CMS instance with any account that has at least "View Entries" permission on one section.
2. Retrieve a valid CSRF token and session cookie: Authenticate via the Craft CMS admin panel and capture the X-CSRF-Token header value and session cookie from browser developer tools or a proxy (e.g., Burp Suite).
3. Enumerate Entry IDs: Brute-force integer Entry IDs (starting from 1 upward) by sending test duplication requests and observing responses to identify valid, accessible entries belonging to other users or restricted sections.
4. Send the duplication request: Issue a crafted POST request to the perform-action endpoint with the target Entry ID:

curl --path-as-is -i -s -k -X POST \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -H 'X-CSRF-Token: <CSRF_TOKEN>' \
  -b '<SESSION_COOKIE>' \
  --data-binary '{"context":"index","elementType":"craft\\elements\\Entry","source":"section:17da21e5-0cfe-41f5-8cd2-450a94f7989c","viewState":{"static":true},"elementAction":"craft\\elements\\actions\\Duplicate","elementIds":[6393]}' \
  'http://craft.local/index.php?p=admin%2Factions%2Felement-indexes%2Fperform-action'

5. Access duplicated content: Observe that a new entry is created under the attacker's ownership, granting full read access to the duplicated content regardless of the original entry's access restrictions (GitHub Advisory).

• Network: Repeated POST requests to /index.php?p=admin/actions/element-indexes/perform-action (or equivalent URL-encoded path) from a single low-privilege user account, especially with sequentially incrementing elementIds values in the JSON body.
• Logs: Craft CMS web/access logs showing a high volume of perform-action requests from the same authenticated session, with elementAction set to craft\elements\actions\Duplicate and varying elementIds.
• Application: Unexpected proliferation of duplicate entries in the CMS, particularly entries owned by a user who should not have had access to the originals; entries with creation timestamps clustered in a short time window.
• Behavior: A low-privilege user account appearing as the owner of entries from sections they do not have edit or create permissions for.

Craft CMS has released patched versions addressing this vulnerability: 4.17.0-beta.1 (for the 4.x branch) and 5.9.0-beta.1 (for the 5.x branch). The fix adds a canDuplicate() permission check in src/elements/actions/Duplicate.php before processing any duplication request, ensuring server-side authorization is enforced regardless of how the request is made. Administrators should upgrade immediately; no configuration-based workaround is available. Additionally, reviewing access logs for suspicious duplication activity and auditing existing entries for unauthorized duplicates is recommended (GitHub Advisory, Craft CMS Commit).

The vulnerability was reported by security researcher mHe4am and published by angrybrad via the Craft CMS GitHub Security Advisory on March 2, 2026. No significant broader media coverage or notable public social media commentary beyond the advisory itself has been identified at this time (GitHub Advisory).