CVE-2026-28782

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28782", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-03T14:25:19.244Z", "datePublished": "2026-03-04T16:36:49.511Z", "dateUpdated": "2026-03-04T17:35:08.922Z"}, "containers": {"cna": {"title": "Craft has a Permission Bypass and IDOR in Duplicate Entry Action", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/craftcms/cms/security/advisories/GHSA-jxm3-pmm2-9gf6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/craftcms/cms/security/advisories/GHSA-jxm3-pmm2-9gf6"}, {"name": "https://github.com/craftcms/cms/commit/fb61a91357f5761c852400185ba931f51d82783d", "tags": ["x_refsource_MISC"], "url": "https://github.com/craftcms/cms/commit/fb61a91357f5761c852400185ba931f51d82783d"}], "affected": [{"vendor": "craftcms", "product": "cms", "versions": [{"version": ">= 5.0.0-RC1, < 5.9.0-beta.1", "status": "affected"}, {"version": ">= 4.0.0-RC1, < 4.17.0-beta.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-04T16:36:49.511Z"}, "descriptions": [{"lang": "en", "value": "Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, the \"Duplicate\" entry action does not properly verify if the user has permission to perform this action on the specific target elements. Even with only \"View Entries\" permission (where the \"Duplicate\" action is restricted in the UI), a user can bypass this restriction by sending a direct request. Furthermore, this vulnerability allows duplicating other users' entries by specifying their Entry IDs. Since Entry IDs are incremental, an attacker can trivially brute-force these IDs to duplicate and access restricted content across the system. This vulnerability is fixed in 5.9.0-beta.1 and 4.17.0-beta.1."}], "source": {"advisory": "GHSA-jxm3-pmm2-9gf6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-04T17:34:53.312489Z", "id": "CVE-2026-28782", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T17:35:08.922Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28782", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-04T17:34:53.312489Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-04T17:35:03.476Z"}}], "cna": {"title": "Craft has a Permission Bypass and IDOR in Duplicate Entry Action", "source": {"advisory": "GHSA-jxm3-pmm2-9gf6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "craftcms", "product": "cms", "versions": [{"status": "affected", "version": ">= 5.0.0-RC1, < 5.9.0-beta.1"}, {"status": "affected", "version": ">= 4.0.0-RC1, < 4.17.0-beta.1"}]}], "references": [{"url": "https://github.com/craftcms/cms/security/advisories/GHSA-jxm3-pmm2-9gf6", "name": "https://github.com/craftcms/cms/security/advisories/GHSA-jxm3-pmm2-9gf6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/craftcms/cms/commit/fb61a91357f5761c852400185ba931f51d82783d", "name": "https://github.com/craftcms/cms/commit/fb61a91357f5761c852400185ba931f51d82783d", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, the \"Duplicate\" entry action does not properly verify if the user has permission to perform this action on the specific target elements. Even with only \"View Entries\" permission (where the \"Duplicate\" action is restricted in the UI), a user can bypass this restriction by sending a direct request. Furthermore, this vulnerability allows duplicating other users' entries by specifying their Entry IDs. Since Entry IDs are incremental, an attacker can trivially brute-force these IDs to duplicate and access restricted content across the system. This vulnerability is fixed in 5.9.0-beta.1 and 4.17.0-beta.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-04T16:36:49.511Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28782", "state": "PUBLISHED", "dateUpdated": "2026-03-04T17:35:08.922Z", "dateReserved": "2026-03-03T14:25:19.244Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-04T16:36:49.511Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "cms", "vendor": "craftcms", "versions": [{"status": "affected", "version": ">= 5.0.0-RC1, < 5.9.0-beta.1"}, {"status": "affected", "version": ">= 4.0.0-RC1, < 4.17.0-beta.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "FD3AD543-D77F-4B2E-AF8D-1C7C724BD26D", "versionEndExcluding": "4.17.0", "versionStartExcluding": "4.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "81B9164E-4845-4D81-A841-378CE4E32485", "versionEndExcluding": "5.9.0", "versionStartExcluding": "5.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:craftcms:craft_cms:4.0.0:-:*:*:*:*:*:*", "matchCriteriaId": "610F6DE9-720F-45B3-81D5-18E7F6B090FD", "vulnerable": true}, {"criteria": "cpe:2.3:a:craftcms:craft_cms:4.0.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "CC2F40FC-7C27-456A-B16D-679410D1D5CF", "vulnerable": true}, {"criteria": "cpe:2.3:a:craftcms:craft_cms:4.0.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "FBAA8227-04F8-404C-907B-B0162B325F5A", "vulnerable": true}, {"criteria": "cpe:2.3:a:craftcms:craft_cms:4.0.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "21B28E2C-327A-4CE6-ACAD-97E459712A55", "vulnerable": true}, {"criteria": "cpe:2.3:a:craftcms:craft_cms:5.0.0:-:*:*:*:*:*:*", "matchCriteriaId": "1C7461CF-35AB-48E1-88B6-956DAE1D2AB4", "vulnerable": true}, {"criteria": "cpe:2.3:a:craftcms:craft_cms:5.0.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "8D8E02D1-601A-4E2B-B619-4775BFDB72D0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, the \"Duplicate\" entry action does not properly verify if the user has permission to perform this action on the specific target elements. Even with only \"View Entries\" permission (where the \"Duplicate\" action is restricted in the UI), a user can bypass this restriction by sending a direct request. Furthermore, this vulnerability allows duplicating other users' entries by specifying their Entry IDs. Since Entry IDs are incremental, an attacker can trivially brute-force these IDs to duplicate and access restricted content across the system. This vulnerability is fixed in 5.9.0-beta.1 and 4.17.0-beta.1."}, {"lang": "es", "value": "Craft es un sistema de gesti\u00f3n de contenido (CMS). Antes de 5.9.0-beta.1 y 4.17.0-beta.1, la acci\u00f3n de entrada 'Duplicar' no verifica correctamente si el usuario tiene permiso para realizar esta acci\u00f3n en los elementos objetivo espec\u00edficos. Incluso con solo el permiso de 'Ver Entradas' (donde la acci\u00f3n 'Duplicar' est\u00e1 restringida en la interfaz de usuario), un usuario puede eludir esta restricci\u00f3n enviando una solicitud directa. Adem\u00e1s, esta vulnerabilidad permite duplicar entradas de otros usuarios especificando sus IDs de Entrada. Dado que los IDs de Entrada son incrementales, un atacante puede forzar por fuerza bruta trivialmente estos IDs para duplicar y acceder a contenido restringido en todo el sistema. Esta vulnerabilidad est\u00e1 corregida en 5.9.0-beta.1 y 4.17.0-beta.1."}], "id": "CVE-2026-28782", "lastModified": "2026-06-17T10:29:02.077", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28782", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-04T17:34:53.312489Z", "version": "2.0.3"}}]}, "published": "2026-03-04T17:16:21.533", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/craftcms/cms/commit/fb61a91357f5761c852400185ba931f51d82783d"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/craftcms/cms/security/advisories/GHSA-jxm3-pmm2-9gf6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0-RC1,5.9.0-beta.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.0.0-RC1,4.17.0-beta.1)"}}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 83.0, "source": "matching"}]}, "original": {"product": "cms", "source": "cna", "vendor": "craftcms"}, "product": "craftcms", "vendor": "craftcms"}], "analysis": {"en": {"generated_at": "2026-04-16T13:32:22.645513+00:00", "value": {"mitigation_remediation": ["Upgrade Craft CMS to version 5.9.0\u2011beta.1, 5.9.0\u2011stable, 4.17.0\u2011beta.1, or any later release. This removes the permission check on the duplicate action and closes the IDOR.", "If an immediate upgrade is not possible, restrict direct access to the duplicate endpoint by implementing network or application\u2011level controls that enforce permission checks before the request reaches the CMS. This can be achieved by configuring web\u2011application firewall rules or by updating .htaccess/NGINX rules to block unauthorized POSTs to /actions/Entry/saveEntryDuplicate or similar paths.", "Review user permissions to ensure that users with only view rights are not assigned extra roles that grant duplicate capability, and consider removing the duplicate action from the UI for view\u2011only roles."], "summary": {"action": "Patch", "impact": "Unauthorized content duplication via permission bypass"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Craft CMS installations running any version earlier than 5.9.0\u2011beta.1 or 4.17.0\u2011beta.1. These include all releases 4.x and 5.x prior to the mentioned beta releases.", "description_and_impact": "Craft CMS allows a user with only view permissions to duplicate entries that belong to other users. The duplicate action bypasses the permission check that the interface shows, and an attacker can supply arbitrary entry IDs. Because entry IDs are sequential, an attacker can brute\u2011force many IDs to access or copy restricted content. The weakness is a classic IDOR/privilege escalation flaw (CWE\u2011639).", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate severity. EPSS is below 1\u202f%, suggesting low current exploitation probability, and the issue is not listed in CISA\u2019s KEV catalog. Attackers can exploit the flaw by sending a crafted HTTP request directly to the duplicate endpoint, optionally brute\u2011forcing entry IDs because they are incremental. Successful exploitation allows duplication of any entry the victim can view, exposing sensitive content across the system. The vulnerability requires no special user privileges beyond a view\u2011only role and no advanced skills, meaning a broad range of attackers could potentially target it."}}}}, "created": "2026-03-05T09:06:59.842289+00:00", "updated": "2026-04-16T13:45:21.942499+00:00", "vendors": ["craftcms", "craftcms$PRODUCT$craftcms"]}