NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘 Packagist
Not in CISA KEV

CVE-2026-72785 — cms

Fix: craftcms/cms@eb63721

CVE-2026-72785 is a CWE-863 vulnerability in craftcms/cms. A fix is available for craftcms/cms — see the affected versions and patch details below.

Craft CMS before 5.10.6 Authorization Bypass via structures/move-element

Also known asGHSA-xxpx-f366-4xpq
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Nov 9, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-72785.

EPSS Exploitation Probability

via FIRST.org ↗
0.3%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs19th percentile — riskier than 19% of all scored CVEsHighest risk
0.00%0.26%0.51%0.77%0.2%0.3%0.3%0.3%Sep 26Nov 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

1 pkg affected
🐘craftcms/cms

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

A control-panel user who holds only the viewCategories permission for a category group (and not saveCategories) can permanently modify that group's category structure — reordering and re-parenting categories via the structures/move-element action.

A read-time authorization grant that a write endpoint later trusts. For categories, the structureEditable flag is computed from the view permission (src/elements/Category.php:205) instead of the save permission (entries correctly use saveEntries — src/elements/Entry.php:341). When the read-only category index renders, craft\base\Element::indexHtml() calls Craft::$app->getSession()->authorize('editStructure:<structureId>'); StructuresController then authorizes the structure-mutating action solely on that session grant, with no canSave re-check.

Verified on Craft CMS 5.10.5. Same class as the moderate-severity authorization bypasses fixed in 5.10.3 and 5.10.5; this is a distinct, unpatched instance.

Impact

A low-privileged, authenticated user (view-only on a category group) can persistently alter the sibling ordering and parent/child nesting of the category taxonomy. Because a category’s URI is derived from its position in the structure (ancestor slugs), moving a category changes its URL and the URLs of its descendants, and can corrupt any navigation/menus built from the category tree. This is an integrity/broken access-control issue: content that the user has no permission to modify is being modified. No confidentiality impact and no RCE; scope is content/taxonomy integrity.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistcraftcms/cms≥ 5.0.0-RC1&&< 5.10.65.10.6composer require craftcms/cms:^5.10.6

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for craftcms/cms, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update craftcms/cms to 5.10.6 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-72785 is resolved across your whole dependency graph.

  3. Workarounds

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

Frequently Asked Questions

A control-panel user who holds only the viewCategories permission for a category group (and not saveCategories) can permanently modify that group's category structure — reordering and re-parenting categories via the structures/move-element action. A read-time authorization grant that a write endpoint later trusts. For categories, the structureEditable flag is computed from the view permission (`src/elements/Category.php:205`) instead of the save permission (entries correctly use saveEntries — `src/elements/Entry.php:341`). When the read-only category index renders, `craft\base\Element::indexH
O3 Security · Impact-Aware SCA

Is CVE-2026-72785 in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-72785: cms RCE — Fixed in 5.10.6