CVE-2026-50279

The record

Craft CMS is a content management system (CMS). IN versions 5.0.0-RC1 and above prior to 5.9.21, theEntriesController::actionSaveEntry() performs entry-edit permission checks before request-controlled author changes are applied to the model, allowing for authorship spoofing. The subsequent author mutation path accepts attacker-supplied authors / author parameters and allows the change when the current user is one of the old authors. Because the controller does not re-run authorization after mutating the author list, a low-privileged user can reassign an entry’s authorship to another user without holding the dedicated peer-author-change permission. This issue has been fixed in version 5.9.21.

Affected packages

Related vulnerabilities

• CVE-2026-62989 Shopper is a Headless e-commerce Admin Panel. CWE-285
• CVE-2026-119330 Immich is a high-performance self-hosted photo and video management solution. CWE-285
• CVE-2026-55551 ZAC is an open-source, workflow-based Common Ground component for Dutch municipal case… CWE-285
• CVE-2026-112905 Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or… CWE-285
• CVE-2026-104316 IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to cancel any… CWE-285
• CVE-2026-113696 Improper authorization in the SmartIT change approval feature of BMC IT Service… CWE-285
• CVE-2026-113694 Improper authorization in the SmartIT user attachment feature of BMC IT Service… CWE-285
• CVE-2026-42949 A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA… CWE-285