CVE-2026-33162: 
PHP vulnerability analysis and mitigation

CVE-2026-33162 is an authorization bypass vulnerability in Craft CMS that allows authenticated control panel users with only the accessCp permission to move entries across sections without the required saveEntries:{sectionUid} permission. It affects Craft CMS versions 5.3.0 through 5.9.13 (inclusive) and was disclosed on March 24, 2026, via a GitHub Security Advisory. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 4.9 (Medium) (Github Advisory, Craft CMS Advisory).

The root cause is classified as CWE-285 (Improper Authorization) and CWE-862 (Missing Authorization). The vulnerable endpoint actionMoveToSection in EntriesController.php accepts sectionId and entryIds parameters and calls Craft::$app->getEntries()->moveEntryToSection($entry, $section) without enforcing per-entry or per-section authorization checks. While a permission check exists in actionMoveToSectionModalData to filter UI options, this check is absent from the actual action endpoint, meaning a direct POST request to /actions/entries/move-to-section bypasses all UI-level filtering. The fix in version 5.9.14 adds a requirePermission("viewEntries:$section->uid") call and introduces a new public Entry::canMove() method that is checked for each entry before the move is executed (Craft CMS Advisory, Patch Commit).

Successful exploitation allows a low-privileged authenticated control panel user to move any entry to any section, regardless of their assigned permissions for either the source or destination section. This violates content integrity and can disrupt editorial workflows, routing logic, and access controls that depend on entries residing in specific sections. There is no confidentiality or availability impact; the risk is confined to unauthorized modification of CMS content structure (Github Advisory, Craft CMS Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.013% (2nd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid authenticated session with at least accessCp permission, limiting the attack surface to users who already have some level of control panel access (Github Advisory).

1. Obtain Control Panel Access: Authenticate to the Craft CMS control panel with any account that has the accessCp permission, even if it lacks saveEntries permissions for any section.
2. Enumerate Sections and Entries: Browse the control panel or query the CMS API to identify valid sectionId values for target sections and entryId values for entries the attacker wishes to move.
3. Craft the Malicious POST Request: Construct a direct HTTP POST request to /actions/entries/move-to-section with the parameters sectionId=<targetSectionId> and entryIds[]=<entryId>, including a valid CSRF token obtained from the authenticated session.
4. Bypass Authorization: Because the endpoint does not enforce saveEntries:{sectionUid} permission checks, the server processes the request and moves the specified entries to the target section without validating the user's permissions.
5. Achieve Objective: The entries are now relocated to the unauthorized section, potentially disrupting routing, editorial controls, or exposing content in unintended sections (Craft CMS Advisory, Patch Commit).

• Network: Unexpected POST requests to /actions/entries/move-to-section originating from user accounts that do not have saveEntries permissions for the involved sections.
• Logs: Craft CMS application logs showing actionMoveToSection calls from low-privileged user accounts; entries in the CMS audit log reflecting section changes not initiated by authorized editors.
• Application: Entries appearing in sections they were not assigned to, particularly if no authorized editor performed the move; discrepancies between expected content structure and actual section assignments in the CMS database.

Upgrade Craft CMS to version 5.9.14 or later, which adds proper authorization checks (requirePermission and canMove()) to the actionMoveToSection endpoint (Craft CMS Release). As an interim workaround, restrict control panel access to only fully trusted users and review existing user permission assignments to minimize the number of accounts with accessCp access. Monitoring CMS audit logs for unexpected entry movements can help detect exploitation attempts until the patch is applied (Craft CMS Advisory).

The vulnerability was reported by researcher GCXWLP and published by Craft CMS maintainer angrybrad on March 24, 2026. The advisory received routine coverage from vulnerability tracking services and aggregators. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified.