Threats Tagged 'ghsa-4hc4-qjfx-wjf3'

Craft CMS versions 5.0.0-RC1 through 5.10.5 contain an authorization vulnerability allowing users with only viewCategories permission to modify the category structure. This occurs because the system incorrectly uses the view permission to authorize structural changes, enabling reordering and re-parenting of categories without proper save permission. Modifying category structure changes category URIs and can disrupt navigation menus. The issue is fixed in version 5.10.6.

Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission (without saveCategories) for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via the structures/move-element action. The structureEditable flag is computed from the view permission rather than the save permission, and the StructuresController authorizes the mutating action on that read-time session grant without a save re-check. Because a category's URI is derived from its position in the structure, moving a category changes its URL and those of its descendants and can corrupt navigation menus built from the category taxonomy. The issue is fixed in 5.10.6.