CVE-2026-72785: 
Craft CMS vulnerability analysis and mitigation

CVE-2026-72785 is an incorrect authorization vulnerability in Craft CMS that allows a control-panel user with only viewCategories permission to permanently modify a category group's structure — reordering and re-parenting categories — via the structures/move-element action. It affects Craft CMS versions 5.0.0-RC1 through 5.10.5 and was published on August 11, 2026, with a fix released in version 5.10.6. The vulnerability carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory, Craft CMS Advisory).

The root cause is CWE-863 (Incorrect Authorization): the structureEditable flag in src/elements/Category.php is computed from the viewCategories permission rather than the saveCategories permission, unlike entries which correctly check saveEntries in src/elements/Entry.php. When the read-only category index renders, craft\base\Element::indexHtml() calls Craft::$app->getSession()->authorize('editStructure:'), and StructuresController subsequently authorizes the mutating structures/move-element action solely on that session-level grant without performing a canSave re-check. This is described as the same class of authorization bypass fixed in Craft CMS 5.10.3 and 5.10.5, but a distinct, previously unpatched instance (Craft CMS Advisory).

A low-privileged, authenticated attacker with only view-only access to a category group can persistently alter the sibling ordering and parent/child nesting of the category taxonomy. Because a category's URI is derived from its position in the structure (ancestor slugs), moving a category changes its URL and the URLs of all its descendants, which can corrupt navigation menus and site links built from the category tree. There is no confidentiality impact and no remote code execution; the scope is limited to content and taxonomy integrity (Craft CMS Advisory, GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability requires an authenticated control-panel user account with at least viewCategories permission, limiting the attacker pool to existing, credentialed users. The EPSS score is approximately 0.194% (9th percentile), indicating a low near-term exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Obtain access: Acquire or compromise a Craft CMS control-panel account that has viewCategories permission for a target category group but lacks saveCategories permission.
2. Load the category index: Navigate to the category group's index page in the control panel. This triggers Element::indexHtml() to call Craft::$app->getSession()->authorize('editStructure:'), storing a session-level authorization grant.
3. Craft the move request: Construct an HTTP POST request to the structures/move-element action endpoint (e.g., /index.php?action=structures/move-element), including parameters specifying the target element ID, the structure ID, and the desired new position (e.g., prevId, parentId).
4. Submit the request: Send the crafted request with the authenticated session cookie. The StructuresController validates only the session-level editStructure: grant (set during the read-only index load) without re-checking canSave, allowing the move to succeed.
5. Observe impact: The targeted category is permanently repositioned in the structure, changing its URI and those of its descendants, and potentially breaking navigation menus or site links that depend on the category taxonomy (Craft CMS Advisory).

• Logs: Craft CMS web/application logs showing POST requests to structures/move-element from user accounts that hold only viewCategories (not saveCategories) permissions; unexpected category structure changes recorded in the CMS audit log.
• Application State: Unexplained changes to category ordering, parent/child relationships, or category URIs in the Craft CMS database (structureelements table); broken or redirected URLs for category pages and their descendants.
• Network: HTTP POST requests to /index.php?action=structures/move-element or equivalent routed paths originating from authenticated sessions of view-only users.

Upgrade Craft CMS to version 5.10.6 or later, which contains the official fix for this vulnerability (Craft CMS Advisory). As a temporary workaround, restrict viewCategories permissions only to users who also hold saveCategories permissions for the same category group, or implement network/application-layer access controls to block unauthorized access to the structures/move-element action endpoint. Auditing existing user permission assignments to identify accounts with view-only category access is also recommended.

The vulnerability was reported by security researcher smakarim and published as a Moderate-severity advisory by the Craft CMS team (user angrybrad) on July 25, 2026, before being assigned a CVE and published to NVD on August 11, 2026 (Craft CMS Advisory). No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time.