In Craft CMS versions from 5.0.0-RC1 up to but not including 5.10.6, a user with only the viewCategories permission can exploit a read-time authorization grant flaw to modify the category structure persistently. The structureEditable flag is incorrectly computed from the view permission instead of the save permission, allowing unauthorized reordering and nesting of categories via the structures/move-element endpoint. This leads to changes in category URIs and can disrupt navigation or menus relying on the category tree. This is an integrity and broken access control issue without confidentiality or code execution impact.

An authenticated user with low privileges (view-only on a category group) can alter the category taxonomy structure, affecting the URLs of categories and their descendants. This compromises content integrity and access control by allowing unauthorized modifications to category ordering and hierarchy. There is no impact on confidentiality or remote code execution.

A patch is available for this vulnerability. Users should upgrade Craft CMS to version 5.10.6 or later where this issue is fixed. No additional mitigation is required once the official fix is applied.