CVE-2026-92589: Missing Authorization in craftcms cms
Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries (but without savePeerEntries) opens another author's entry in read-only mode, Craft unconditionally grants that session a `manageNestedElements::<ownerId>::field:<handle>` authorization flag for the entry's Matrix/Address fields. Unlike the corresponding delete endpoint, actions/nested-elements/reorder trusts this session flag alone and never rechecks the caller's save permission for the owner element. As a result, a view-only user can POST to actions/nested-elements/reorder using the ownerElementType, ownerId, ownerSiteId, attribute, elementIds, and offset parameters present in the read-only page source and rewrite the sort order of Matrix blocks or Addresses belonging to content they are explicitly denied save access to.
AI Analysis
Technical Summary
CVE-2026-92589 is a broken access control vulnerability in Craft CMS affecting versions 5.0.0 through 5.10.12. The issue arises in the nested-elements reorder endpoint, where an authenticated user with viewEntries and viewPeerEntries permissions but without savePeerEntries permission can gain a session authorization flag allowing them to reorder nested Matrix or Address blocks of entries they can only view in read-only mode. The endpoint trusts this session flag without rechecking save permissions, enabling unauthorized modification of the sort order of nested elements. This vulnerability is addressed in Craft CMS version 5.10.13.
Potential Impact
An authenticated user with limited view permissions can reorder nested elements (Matrix blocks or Addresses) of entries they are not authorized to modify. This could lead to unauthorized changes in content structure or presentation, potentially affecting content integrity or user experience. There is no indication of privilege escalation beyond this scope or direct data disclosure.
Mitigation Recommendations
Upgrade Craft CMS to version 5.10.13 or later, where this broken access control flaw is fixed. No other mitigations are indicated or required.
CVE-2026-92589: Missing Authorization in craftcms cms
Description
Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries (but without savePeerEntries) opens another author's entry in read-only mode, Craft unconditionally grants that session a `manageNestedElements::<ownerId>::field:<handle>` authorization flag for the entry's Matrix/Address fields. Unlike the corresponding delete endpoint, actions/nested-elements/reorder trusts this session flag alone and never rechecks the caller's save permission for the owner element. As a result, a view-only user can POST to actions/nested-elements/reorder using the ownerElementType, ownerId, ownerSiteId, attribute, elementIds, and offset parameters present in the read-only page source and rewrite the sort order of Matrix blocks or Addresses belonging to content they are explicitly denied save access to.
CVSS v4.0
Score 5.3medium
Affected software
craftcms
cms
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-92589 is a broken access control vulnerability in Craft CMS affecting versions 5.0.0 through 5.10.12. The issue arises in the nested-elements reorder endpoint, where an authenticated user with viewEntries and viewPeerEntries permissions but without savePeerEntries permission can gain a session authorization flag allowing them to reorder nested Matrix or Address blocks of entries they can only view in read-only mode. The endpoint trusts this session flag without rechecking save permissions, enabling unauthorized modification of the sort order of nested elements. This vulnerability is addressed in Craft CMS version 5.10.13.
Potential Impact
An authenticated user with limited view permissions can reorder nested elements (Matrix blocks or Addresses) of entries they are not authorized to modify. This could lead to unauthorized changes in content structure or presentation, potentially affecting content integrity or user experience. There is no indication of privilege escalation beyond this scope or direct data disclosure.
Mitigation Recommendations
Upgrade Craft CMS to version 5.10.13 or later, where this broken access control flaw is fixed. No other mitigations are indicated or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-16T13:47:49.170Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aab120655bf5e2cf536882f
Added to database: 09/16/2026, 22:02:46 UTC
Last enriched: 09/16/2026, 23:13:34 UTC
Last updated: 09/17/2026, 03:39:49 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.