CyberRota Analysis
AI-GeneratedCraft CMS versions 5.0.0-RC1 through 5.10.5 are vulnerable due to an incorrect authorization flaw that allows users with only view permissions to modify category structures, including reordering and re-parenting categories. This can lead to broken URLs and corrupted navigation menus, impacting website functionality and user experience. Organizations using affected versions should prioritize upgrading to 5.10.6 to mitigate potential disruptions and maintain the integrity of their category taxonomy.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Craft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission (without saveCategories) for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via the structures/move-element action. The structureEditable flag is computed from the view permission rather than the save permission, and the StructuresController authorizes the mutating action on that read-time session grant without a save re-check. Because a category's URI is derived from its position in the structure, moving a category changes its URL and those of its descendants and can corrupt navigation menus built from the category taxonomy. The issue is fixed in 5.10.6.