Authorization Bypass in Craft CMS Affecting Category Management

CVE-2026-72785

What is CVE-2026-72785?

Craft CMS versions 5.0.0-RC1 through 5.10.5 have a vulnerability that allows users with limited permissions (viewCategories only) to modify category structures through the structures/move-element action. This misconfiguration leads to unauthorized changes including reordering and re-parenting categories, which can corrupt navigation menus dependent on the category taxonomy. The issue arises from a failure to correctly validate permissions at the time of action, allowing unintended modifications to the category hierarchy. The vulnerability has been addressed in version 5.10.6.

References