In Craft CMS versions 5.0.0-RC1 through 5.9.20, the EntriesController::actionMoveToSection() endpoint improperly gates the destination section by checking only viewEntries permission instead of requiring saveEntries permission. Although the source entry's move permission is checked, this allows a user with limited privileges to move an entry into a section where they only have read access. This bypasses the section-level authorization model, enabling unauthorized content modification and interference with editorial and workflow controls. The vulnerability is addressed in version 5.9.21.

An authenticated control-panel user with low privileges can move entries into sections where they lack write permissions, violating access controls. This can lead to unauthorized content injection, disruption of editorial boundaries, approval workflows, and section-specific business logic. The integrity of protected sections can be compromised, potentially affecting content governance and operational processes.

This vulnerability is fixed in Craft CMS version 5.9.21. Users should upgrade to version 5.9.21 or later to remediate this issue. No official patch or temporary workaround is provided in the advisory. Until upgrading, restrict control-panel user permissions carefully to minimize risk.