CVE-2026-72785 is an incorrect authorization vulnerability in Craft CMS affecting versions 5.0.0-RC1 through 5.10.5. A user with only the viewCategories permission can exploit the structures/move-element action to reorder and re-parent categories, despite lacking saveCategories permission. This occurs because the system incorrectly bases the structureEditable flag on view permission rather than save permission, and the StructuresController authorizes mutating actions without verifying save permissions during the session. Since category URIs depend on their position in the structure, unauthorized moves alter URLs and can disrupt navigation menus. The vulnerability is resolved in Craft CMS 5.10.6.

An attacker with limited permissions (viewCategories only) can make unauthorized changes to the category structure, including reordering and re-parenting categories. This can lead to changes in category URLs and their descendants, potentially breaking navigation menus and causing site navigation issues. The vulnerability does not require elevated privileges beyond viewCategories and can be exploited without user interaction or additional authentication. There are no known exploits in the wild as of the publication date.

A fix is available in Craft CMS version 5.10.6. Users should upgrade to 5.10.6 or later to remediate this vulnerability. Until the upgrade is applied, restrict control-panel user permissions to prevent users with only viewCategories permission from accessing the structures/move-element action or performing category structure modifications.