Craft CMS: Authorship spoofing in `entries/save-entry` via pre-check/post-mutation authorization gap

Summary

EntriesController::actionSaveEntry() performs entry-edit permission checks before request-controlled author changes are applied to the model. The subsequent author mutation path accepts attacker-supplied authors / author parameters and allows the change when the current user is one of the old authors. Because the controller does not re-run authorization after mutating the author list, a low-privileged user can reassign an entry’s authorship to another user without holding the dedicated peer-author-change permission.

Details

The control flow begins in EntriesController.php:249. actionSaveEntry() loads the entry and enforces edit permissions before calling _populateEntryModel():

public function actionSaveEntry(bool $duplicate = false): ?Response
{
    ...
    $entry = $this->_editableEntry($this->request->getBodyParam('entryId'), $siteId);
    ...
    $this->enforceEditEntryPermissions($entry, $duplicate);
    ...
    $this->_populateEntryModel($entry);
    ...
    $success = Craft::$app->getElements()->saveElement($entry);
}

The attacker-controlled source is in EntriesController.php:588:

$entry->setAttributesFromRequest(array_filter([
    'authorIds' => $this->request->getBodyParam('authors') ??
        $this->request->getBodyParam('author') ??
        $entry->getAuthorId() ??
        static::currentUser()->id,
]));

Entry::setAttributesFromRequest() in Entry.php:1124 extracts the new author IDs and applies them if canChangeAuthor() returns true:

if (
    ($authorIds !== null || $authorId !== null) &&
    $this->canChangeAuthor()
) {
    $this->_oldAuthorIds = $oldAuthorIds;
    $this->setAuthorIds($authorIds);
}

canChangeAuthor() at Entry.php:2789 allows the author change when the current user can view peer entries and is already one of the existing authors:

return (
    empty($authorIds) ||
    in_array($user->id, $authorIds) ||
    $user->can("changeAuthorForPeerEntries:$section->uid")
);

After the author list is mutated, the controller does not re-check authorization.