| Package | Affected versions | Patched versions |
|---|
| craftcms/cms Packagist | ≥ 5.3.0, < 5.9.14
| 5.9.14
|
| craft cms | ≥ 5.3.0, < 5.9.14
| 5.9.14
|
Description
Summary
An authenticated control panel user with only accessCp can move entries across sections via POST /actions/entries/move-to-section, even when they do not have saveEntries:{sectionUid} permission for either source or destination section.
Details
Root-cause analysis
- actionMoveToSection accepts sectionId and entryIds, loads entries, and iterates:
Craft::$app->getEntries()->moveEntryToSection($entry, $section).
- The endpoint does not enforce per-entry or per-section authorization checks.
moveEntryToSection() also does not enforce current-user authorization.- There is a permission check in
actionMoveToSectionModalData for building UI options, but that check is not enforced in the actual endpoint.
- Therefore, a direct POST request can bypass UI filtering and perform unauthorized entry moves.
Impact
- This is an authorization bypass permitting unauthorized content changes.
- Authenticated low-privileged control panel users can move entries they should not be able to manage, violating integrity and potentially disrupting routing/editorial controls.
NVD description
Craft CMS is a content management system (CMS). From version 5.3.0 to before version 5.9.14, an authenticated control panel user with only accessCp can move entries across sections via POST /actions/entries/move-to-section, even when they do not have saveEntries:{sectionUid} permission for either source or destination section. This issue has been patched in version 5.9.14.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free