CVE-2026-72785
A permanent, source-backed tracker page. Values are shown only when returned; explicit gaps and read failures remain different states.
What it is
ReportedCraft CMS 5.0.0-RC1 through 5.10.5 contains an incorrect authorization vulnerability. A control-panel user holding only the viewCategories permission (without saveCategories) for a category group can permanently modify that group's category structure — reordering and re-parenting categories — via the structures/move-element action. The structureEditable flag is computed from the view permission rather than the save permission, and the StructuresController authorizes the mutating action on that read-time session grant without a save re-check.… Source description excerpt; complete tracked detail loads below.
Evidence: Source reported · Source: CVE record · Source last published: 2026-08-11 12:17 UTC · Source last updated: 2026-08-11 12:48 UTC · Tracker data as of: 2026-08-11 13:56 UTC
What is affected
Reportedcraftcms — cms. Product-level identification only; no affected-version conclusion is available from this field.
Evidence: Source reported · Source: CVE record · Source last published: 2026-08-11 12:17 UTC · Source last updated: 2026-08-11 12:48 UTC · Tracker data as of: 2026-08-11 13:56 UTC
Urgency and basis
ReportedTrack* · 217.9
Evidence: Tracker computed · Tracker decision tier from the evidence detailed below · Source last updated: 2026-08-11 12:48 UTC · Tracker data as of: 2026-08-11 13:56 UTC
Exploitation evidence
Not reportedNot reported by tracked sources.
What to do
ReportedA source remediation link is available. Validate that guidance against the affected product and your environment.
Source remediation ↗Evidence: Source reported · Tracked source remediation field · Source last updated: 2026-08-11 12:48 UTC · Tracker data as of: 2026-08-11 13:56 UTC
Evidence detail
Loading the full tracker evidence record…