CVE-2026-50281: 
PHP vulnerability analysis and mitigation

CVE-2026-50281 is a mass-assignment vulnerability in Craft CMS's bulk-duplicate element action, classified as "Mass assignment via id in newAttributes during bulk duplicate overwrites existing elements." It affects Craft CMS versions 5.7.0 through 5.9.20 (i.e., >= 5.7.0, < 5.9.21) and was first published by the GitHub Advisory Database on May 29, 2026, with NVD publication on July 2, 2026. The vulnerability carries a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, Feedly).

The root cause is CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes): ElementsController::beforeAction() correctly rejects top-level id or canonicalId keys in the request body, but actionBulkDuplicate() reads a separate newAttributes array and passes it directly to the service layer without stripping the id key. In Elements::duplicateElement(), the element is cloned and its id is reset to null, but Craft::configure() is then called with the attacker-supplied array, which overwrites the null reset with any numeric id value provided. Because safeAttributes() on the Entry model exposes id from the base element model, the Collection::only() filter does not remove it, and Yii's saveElement() subsequently performs a database UPDATE against the target row's primary key instead of an INSERT, writing the attacker's title, slug, authorId, postDate, and UID into the victim's entry (GitHub Advisory).

A low-privileged authenticated user with only the permission to duplicate their own entries can overwrite the metadata of any other element in the Craft CMS installation — including entries, categories, and users sharing the Entry element table — by supplying an arbitrary target element ID. The attacker can replace the victim entry's title, slug, author ID, post date, and UID, breaking content integrity across the entire install. There is no confidentiality or availability impact, but the integrity impact is high, as content belonging to other authors can be silently tampered with (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and the NVD SSVC assessment rates exploitation as "none" and automation as "no." The EPSS score is approximately 0.253% (17th percentile), indicating a low near-term exploitation probability. The vulnerability was reported by researcher "adrgs" (GitHub Advisory).

1. Authenticate: Log in to the target Craft CMS instance (versions 5.7.0–5.9.20) with a low-privileged account that has permission to duplicate at least one entry the attacker owns.
2. Enumerate target element IDs: Identify the numeric element ID of the victim's entry by browsing the CMS, inspecting page source, or using Craft's element query API endpoints to enumerate accessible IDs.
3. Craft the malicious request: Prepare a POST request to the bulk-duplicate action endpoint (e.g., /actions/elements/bulk-duplicate) with a valid elements parameter referencing the attacker's own entry, and a newAttributes parameter containing {"id": <victim_element_id>, "title": "...", "slug": "...", "authorId": <attacker_id>}.
4. Submit the request: Send the crafted request. The id key in newAttributes bypasses the top-level check in beforeAction(), passes through Collection::only() (since id is in safeAttributes()), and is applied via Craft::configure(), overwriting the id = null reset.
5. Trigger the UPDATE: Yii's saveElement() detects a non-null id and issues a SQL UPDATE against the victim's row, writing the attacker's supplied title, slug, authorId, postDate, and UID into the victim's entry instead of creating a new record (GitHub Advisory).

• Logs: Craft CMS application logs showing POST requests to the bulk-duplicate action endpoint (e.g., /actions/elements/bulk-duplicate) from a low-privileged user account, particularly with newAttributes containing an id field not matching the user's own entries.
• Database: Unexpected changes to title, slug, authorId, postDate, or uid columns in the elements or entries database tables for entries not owned by the modifying user, especially where the dateUpdated timestamp does not align with legitimate editorial activity.
• Application Behavior: Entries appearing with mismatched authorship (e.g., author changed to a low-privileged user) or unexpected slug/title modifications without corresponding audit trail entries from the legitimate owner.

Upgrade Craft CMS to version 5.9.21 or later, which contains the fix for this vulnerability (commit 8f6587c) (GitHub Commit, GitHub Advisory). As a short-term workaround where immediate upgrade is not possible, restrict entry duplication permissions to only fully trusted users. Additionally, monitor entry modification logs for unexpected changes to title, slug, authorId, postDate, and UID fields on entries not owned by the modifying user.