Craft CMS, a widely used content management system, suffers from an authorization bypass vulnerability identified as CVE-2026-28782 (CWE-639). The vulnerability exists in the 'Duplicate' entry action prior to versions 5.9.0-beta.1 and 4.17.0-beta.1. Normally, the CMS restricts the duplication of entries based on user permissions, allowing only authorized users to duplicate specific content. However, due to improper permission verification on the server side, users with only 'View Entries' permission—who are not authorized to duplicate entries—can bypass these restrictions by sending direct HTTP requests to the duplication endpoint. The vulnerability is exacerbated by the use of incremental Entry IDs, which attackers can brute-force to enumerate and duplicate entries belonging to other users. This leads to unauthorized duplication and potential exposure of restricted content. The flaw does not require user interaction or elevated privileges beyond view access, making exploitation relatively straightforward. The vulnerability has a CVSS 4.0 base score of 5.3, reflecting medium severity, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No known exploits are reported in the wild as of the publication date. The issue is resolved in Craft CMS versions 5.9.0-beta.1 and 4.17.0-beta.1 by properly enforcing permission checks on the duplication action.

This vulnerability primarily impacts the confidentiality of content managed within Craft CMS instances. Attackers with minimal permissions can access and duplicate entries they should not be able to, potentially exposing sensitive or proprietary information. This can lead to data leakage, intellectual property theft, or unauthorized content manipulation. Organizations relying on Craft CMS for managing critical or sensitive content may face reputational damage, compliance violations, or competitive disadvantage if exploited. The ease of exploitation—no elevated privileges or user interaction required—and the ability to brute-force Entry IDs increase the risk of widespread unauthorized access within affected systems. While the vulnerability does not directly impact system availability or integrity, the unauthorized duplication and exposure of content can have significant operational and business consequences.

Organizations should upgrade Craft CMS to versions 5.9.0-beta.1 or later, or 4.17.0-beta.1 or later, where the vulnerability is patched. Until upgrading is possible, administrators should restrict 'View Entries' permissions to trusted users only and monitor logs for suspicious duplication requests or unusual activity involving entry duplication endpoints. Implementing web application firewall (WAF) rules to detect and block anomalous requests targeting duplication functionality can reduce exploitation risk. Additionally, consider obfuscating or randomizing Entry IDs if customization is feasible to hinder brute-force enumeration. Regularly audit user permissions to ensure least privilege principles are enforced, minimizing the number of users with view-only access. Finally, maintain vigilant monitoring and incident response capabilities to quickly detect and respond to potential exploitation attempts.