Description

Craft CMS is a content management system (CMS). From version 5.3.0 to before version 5.9.14, an authenticated control panel user with only accessCp can move entries across sections via POST /actions/entries/move-to-section, even when they do not have saveEntries:{sectionUid} permission for either source or destination section. This issue has been patched in version 5.9.14.

Remediation

References

CVE-2026-33162

Related Vulnerabilities

WordPress Plugin Multiple Page Generator-MPG Cross-Site Request Forgery (3.3.9)

WordPress Plugin Arigato Autoresponder and Newsletter Cross-Site Scripting (2.3.1)

Moodle Incorrect Default Permissions Vulnerability (CVE-2024-45690)

WordPress Plugin Everest Review Lite-User/Admin review for WordPress includes Backdoor [Only if downloaded via the vendor website] (1.0.7)

Craft CMS Missing Encryption of Sensitive Data Vulnerability (CVE-2018-20465)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities CWE-285 CVE-2026-33162