PT-2026-22951 · Craft · Craft

Mhe4Am · Published 2026-03-03 · Updated 2026-03-04 · CVE-2026-28782

Positive Technologies (AI Summary)

CVSS v4.0

5.6

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions Craft versions prior to 5.9.0-beta.1 Craft versions prior to 4.17.0-beta.1

Description Craft is a content management system (CMS). A flaw exists where the "Duplicate" entry action does not properly verify user permissions for specific target elements. Even with limited "View Entries" permission, a user can bypass UI restrictions by sending a direct request. This allows duplication of other users' entries by specifying their Entry IDs. Because Entry IDs are incremental, an attacker can potentially brute-force these IDs to duplicate and access restricted content. The vulnerability is exploitable via a direct request to the ''/index.php?p=admin%2Factions%2Felement-indexes%2Fperform-action'' API endpoint, utilizing the elementIds parameter. The request requires a valid CSRF token and cookie.

Recommendations Versions prior to 5.9.0-beta.1 should be updated to 5.9.0-beta.1 or later. Versions prior to 4.17.0-beta.1 should be updated to 4.17.0-beta.1 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-28782

GHSA-JXM3-PMM2-9GF6

Affected Products

Craft

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28782.json · Exploit
• https://github.com/craftcms/cms/security/advisories/GHSA-jxm3-pmm2-9gf6 · Vendor Advisory
• https://github.com/craftcms/cms/commit/fb61a91357f5761c852400185ba931f51d82783d · Patch
• https://osv.dev/vulnerability/CVE-2026-28782 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jxm3-pmm2-9gf6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28782 · Security Note
• https://github.com/craftcms/cms · Note
• https://twitter.com/CVEnew/status/2029272833608605888 · Twitter Post