Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
11 vulnerabilities
CVE-2026-115938 (GCVE-0-2026-115938)
Vulnerability from cvelistv5 – Published: 2026-10-23 21:58 – Updated: 2026-10-23 21:58
VLAI
EPSS
VEX
Title
Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE
Summary
Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft’s allowed column filter delegates property lookup to Yii ArrayHelper, outside Twig’s SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox’s empty property/method allowlists.
The vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID 1 when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle.
After recovering GeneralConfig::securityKey, the same user can compute Craft’s generic HMAC wire format offline. Signed parameters such as redirect are then accepted and passed to unsandboxed View::renderObjectTemplate(), where Twig’s string-callable form can invoke native PHP callables. The regression proof uses the harmless substr() callback and observes abcdef becoming cdef; it does not execute an OS command.
Severity
CWE
- CWE-1336 - Improper neutralization of special elements used in a template engine
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.hckrt.com/hacktivity/HCKRT-DRNL9W | third-party-advisorytechnical-descriptionmitigation |
| https://github.com/craftcms/cms/releases/tag/5.11.2 | release-notes |
| https://github.com/craftcms/cms | product |
| https://github.com/craftcms/cms/security/advisori… | third-party-advisory |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "craftcms/cms",
"product": "cms",
"vendor": "craftcms",
"versions": [
{
"lessThan": "5.11.2",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
},
{
"lessThan": "4.18.9",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.2",
"versionStartIncluding": "5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.18.9",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mohamed Wagdy (@Kalawy)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Hackrate"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCraft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft\u2019s allowed\u0026nbsp;\u003ccode\u003ecolumn\u003c/code\u003e\u0026nbsp;filter delegates property lookup to Yii\u0026nbsp;\u003ccode\u003eArrayHelper\u003c/code\u003e, outside Twig\u2019s\u0026nbsp;\u003ccode\u003eSecurityPolicy\u003c/code\u003e. Repeated single-segment lookups therefore bypass the sandbox\u2019s empty property/method allowlists.\u003c/p\u003e\u003cp\u003eThe vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID\u0026nbsp;\u003ccode\u003e1\u003c/code\u003e\u0026nbsp;when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle.\u003c/p\u003e\u003cp\u003eAfter recovering\u0026nbsp;\u003ccode\u003eGeneralConfig::securityKey\u003c/code\u003e, the same user can compute Craft\u2019s generic HMAC wire format offline. Signed parameters such as\u0026nbsp;\u003ccode\u003eredirect\u003c/code\u003e\u0026nbsp;are then accepted and passed to unsandboxed\u0026nbsp;\u003ccode\u003eView::renderObjectTemplate()\u003c/code\u003e, where Twig\u2019s string-callable form can invoke native PHP callables. The regression proof uses the harmless\u0026nbsp;\u003ccode\u003esubstr()\u003c/code\u003e\u0026nbsp;callback and observes\u0026nbsp;\u003ccode\u003eabcdef\u003c/code\u003e\u0026nbsp;becoming\u0026nbsp;\u003ccode\u003ecdef\u003c/code\u003e; it does not execute an OS command.\u003c/p\u003e"
}
],
"value": "Craft CMS allows any authenticated control panel user to submit an element-search condition whose element selector is evaluated as a sandboxed Twig object template. Craft\u2019s allowed\u00a0column\u00a0filter delegates property lookup to Yii\u00a0ArrayHelper, outside Twig\u2019s\u00a0SecurityPolicy. Repeated single-segment lookups therefore bypass the sandbox\u2019s empty property/method allowlists.\n\n\n\nThe vulnerable condition value is ultimately cast to an integer. That does not protect the secret: the template can return author ID\u00a01\u00a0when a guessed key character is correct and an impossible ID otherwise. The JSON endpoint returns entries for the first case and an empty array for the second, forming a stable remote character oracle.\n\n\n\nAfter recovering\u00a0GeneralConfig::securityKey, the same user can compute Craft\u2019s generic HMAC wire format offline. Signed parameters such as\u00a0redirect\u00a0are then accepted and passed to unsandboxed\u00a0View::renderObjectTemplate(), where Twig\u2019s string-callable form can invoke native PHP callables. The regression proof uses the harmless\u00a0substr()\u00a0callback and observes\u00a0abcdef\u00a0becoming\u00a0cdef; it does not execute an OS command."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336 Improper neutralization of special elements used in a template engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T21:58:51.816Z",
"orgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
"shortName": "Hackrate"
},
"references": [
{
"tags": [
"third-party-advisory",
"technical-description",
"mitigation"
],
"url": "https://www.hckrt.com/hacktivity/HCKRT-DRNL9W"
},
{
"tags": [
"release-notes"
],
"url": "https://github.com/craftcms/cms/releases/tag/5.11.2"
},
{
"tags": [
"product"
],
"url": "https://github.com/craftcms/cms"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-v4q3-2g5g-wjj6"
}
],
"source": {
"advisory": "GHSA-v4q3-2g5g-wjj6",
"discovery": "UNKNOWN"
},
"title": "Low privilege condition filter escapes Twig sandbox, recovers \"securityKey\" and reaches RCE",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
"assignerShortName": "Hackrate",
"cveId": "CVE-2026-115938",
"datePublished": "2026-10-23T21:58:51.816Z",
"dateReserved": "2026-10-23T21:25:32.945Z",
"dateUpdated": "2026-10-23T21:58:51.816Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115937 (GCVE-0-2026-115937)
Vulnerability from cvelistv5 – Published: 2026-10-23 21:50 – Updated: 2026-10-23 21:50
VLAI
EPSS
VEX
Title
Unauthenticated payment reuse allows unpaid orders to be marked as paid
Summary
The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together:
* commerceTransactionHash — selects which Craft Commerce transaction is completed
* id — selects which Mollie payment is queried for its status
An unauthenticated attacker holding any paid Mollie payment ID from the merchant’s account can pair it with any transaction hash.
Commerce queries Mollie, sees status: paid, and marks the target transaction successful for that transaction’s full
amount, regardless of how much was actually paid.
Severity
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.hckrt.com/hacktivity/HCKRT-6RB2BC | third-party-advisorytechnical-descriptionmitigation |
| https://github.com/craftcms/commerce-mollie/relea… | release-notes |
| https://github.com/craftcms/commerce-mollie | product |
| https://github.com/craftcms/commerce-mollie/secur… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| craftcms | commerce-mollie |
Affected:
2.1.1 , < 4.4.3
(semver)
cpe:2.3:a:craftcms:commerce-mollie:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "craftcms/commerce-mollie",
"product": "commerce-mollie",
"vendor": "craftcms",
"versions": [
{
"lessThan": "4.4.3",
"status": "affected",
"version": "2.1.1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:craftcms:commerce-mollie:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.4.3",
"versionStartIncluding": "2.1.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "@ouribe"
},
{
"lang": "en",
"type": "coordinator",
"value": "Hackrate"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together:\u003c/p\u003e\u003cul\u003e\u003cli\u003e\u003ccode\u003ecommerceTransactionHash\u003c/code\u003e\u0026nbsp;\u2014 selects which Craft Commerce transaction is completed\u003c/li\u003e\u003cli\u003e\u003ccode\u003eid\u003c/code\u003e\u0026nbsp;\u2014 selects which Mollie payment is queried for its status\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eAn unauthenticated attacker holding any paid Mollie payment ID from the merchant\u2019s account can pair it with any transaction hash.\u003c/p\u003e\u003cp\u003eCommerce queries Mollie, sees\u0026nbsp;\u003ccode\u003estatus: paid\u003c/code\u003e, and marks the target transaction successful for that transaction\u2019s full\u003cbr\u003eamount, regardless of how much was actually paid.\u003c/p\u003e"
}
],
"value": "The Mollie webhook endpoint accepts two independent, attacker-controlled parameters and never verifies that they belong together:\n\n * commerceTransactionHash\u00a0\u2014 selects which Craft Commerce transaction is completed\n * id\u00a0\u2014 selects which Mollie payment is queried for its status\n\n\n\n\nAn unauthenticated attacker holding any paid Mollie payment ID from the merchant\u2019s account can pair it with any transaction hash.\n\n\n\nCommerce queries Mollie, sees\u00a0status: paid, and marks the target transaction successful for that transaction\u2019s full\namount, regardless of how much was actually paid."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345 Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T21:50:13.188Z",
"orgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
"shortName": "Hackrate"
},
"references": [
{
"tags": [
"third-party-advisory",
"technical-description",
"mitigation"
],
"url": "https://www.hckrt.com/hacktivity/HCKRT-6RB2BC"
},
{
"tags": [
"release-notes"
],
"url": "https://github.com/craftcms/commerce-mollie/releases/tag/4.4.3"
},
{
"tags": [
"product"
],
"url": "https://github.com/craftcms/commerce-mollie"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/craftcms/commerce-mollie/security/advisories/GHSA-3qcx-mjf6-48vj"
}
],
"source": {
"advisory": "GHSA-3qcx-mjf6-48vj",
"discovery": "UNKNOWN"
},
"title": "Unauthenticated payment reuse allows unpaid orders to be marked as paid",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
"assignerShortName": "Hackrate",
"cveId": "CVE-2026-115937",
"datePublished": "2026-10-23T21:50:13.188Z",
"dateReserved": "2026-10-23T21:25:09.997Z",
"dateUpdated": "2026-10-23T21:50:13.188Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-115935 (GCVE-0-2026-115935)
Vulnerability from cvelistv5 – Published: 2026-10-23 21:40 – Updated: 2026-10-23 21:40
VLAI
EPSS
VEX
Title
Control panel only API response emulation replaces "securityKey" and reaches server RCE
Summary
The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user.
A non-admin user with only accessCp can place newline characters in X-Craft-Plugin-Licenses. Craft passes this value to its .env writer without removing the newlines.
This lets the user insert a new attacker-known CRAFT_SECURITY_KEY into .env. After Craft loads that key, the user can forge a signed login redirect containing a Twig system() callback.
This is different from the previous report. That report reads the existing key through a Twig sandbox bypass. This report replaces the key through fake API headers and CRLF injection. Fixing either source does not fix the other.
Severity
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.hckrt.com/hacktivity/HCKRT-WM3VSE | third-party-advisorytechnical-descriptionmitigation |
| https://github.com/craftcms/cms/releases/tag/5.11.2 | release-notes |
| https://github.com/craftcms/cms | product |
| https://github.com/craftcms/cms/security/advisori… | third-party-advisory |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "craftcms/cms",
"product": "cms",
"vendor": "craftcms",
"versions": [
{
"lessThan": "5.11.2",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
},
{
"lessThan": "4.18.9",
"status": "affected",
"version": "4.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.2",
"versionStartIncluding": "5.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.18.9",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mohamed Wagdy (@Kalawy)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Hackrate"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe\u0026nbsp;\u003ccode\u003eapp/process-api-response-headers\u003c/code\u003e\u0026nbsp;action accepts fake Craft API response headers from any authenticated control panel user.\u003c/p\u003e\u003cp\u003eA non-admin user with only\u0026nbsp;\u003ccode\u003eaccessCp\u003c/code\u003e\u0026nbsp;can place newline characters in\u0026nbsp;\u003ccode\u003eX-Craft-Plugin-Licenses\u003c/code\u003e. Craft passes this value to its\u0026nbsp;\u003ccode\u003e.env\u003c/code\u003e\u0026nbsp;writer without removing the newlines.\u003c/p\u003e\u003cp\u003eThis lets the user insert a new attacker-known\u0026nbsp;\u003ccode\u003eCRAFT_SECURITY_KEY\u003c/code\u003e\u0026nbsp;into\u0026nbsp;\u003ccode\u003e.env\u003c/code\u003e. After Craft loads that key, the user can forge a signed login redirect containing a Twig\u0026nbsp;\u003ccode\u003esystem()\u003c/code\u003e\u0026nbsp;callback.\u003c/p\u003e\u003cp\u003eThis is different from the previous report. That report reads the existing key through a Twig sandbox bypass. This report replaces the key through fake API headers and CRLF injection. Fixing either source does not fix the other.\u003c/p\u003e"
}
],
"value": "The\u00a0app/process-api-response-headers\u00a0action accepts fake Craft API response headers from any authenticated control panel user.\n\n\n\nA non-admin user with only\u00a0accessCp\u00a0can place newline characters in\u00a0X-Craft-Plugin-Licenses. Craft passes this value to its\u00a0.env\u00a0writer without removing the newlines.\n\n\n\nThis lets the user insert a new attacker-known\u00a0CRAFT_SECURITY_KEY\u00a0into\u00a0.env. After Craft loads that key, the user can forge a signed login redirect containing a Twig\u00a0system()\u00a0callback.\n\n\n\nThis is different from the previous report. That report reads the existing key through a Twig sandbox bypass. This report replaces the key through fake API headers and CRLF injection. Fixing either source does not fix the other."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T21:40:57.592Z",
"orgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
"shortName": "Hackrate"
},
"references": [
{
"tags": [
"third-party-advisory",
"technical-description",
"mitigation"
],
"url": "https://www.hckrt.com/hacktivity/HCKRT-WM3VSE"
},
{
"tags": [
"release-notes"
],
"url": "https://github.com/craftcms/cms/releases/tag/5.11.2"
},
{
"tags": [
"product"
],
"url": "https://github.com/craftcms/cms"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-9hp6-3565-gvh5"
}
],
"source": {
"advisory": "GHSA-9hp6-3565-gvh5",
"discovery": "UNKNOWN"
},
"title": "Control panel only API response emulation replaces \"securityKey\" and reaches server RCE",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
"assignerShortName": "Hackrate",
"cveId": "CVE-2026-115935",
"datePublished": "2026-10-23T21:40:57.592Z",
"dateReserved": "2026-10-23T21:23:18.607Z",
"dateUpdated": "2026-10-23T21:40:57.592Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105985 (GCVE-0-2026-105985)
Vulnerability from cvelistv5 – Published: 2026-10-06 10:23 – Updated: 2026-10-07 03:55
VLAI
EPSS
VEX
Title
Authenticated RCE via render-components Entry Type overrides
Summary
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components.
Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an EntryType object’s uiLabelFormat and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by renderObjectTemplate().
This render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as system(), resulting in operating-system command execution with the privileges of the PHP/web-server process.
The issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 00:00 UTC
CWE
- CWE-1336 - Improper neutralization of special elements used in a template engine
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.hckrt.com/hacktivity/HCKRT-PVWH7W | third-party-advisorytechnical-descriptionmitigation |
| https://github.com/craftcms/cms/releases/tag/5.11.0 | release-notes |
| https://github.com/craftcms/cms | product |
| https://github.com/craftcms/cms/security/advisori… | third-party-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105985",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T03:55:21.500Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "craftcms/cms",
"product": "cms",
"vendor": "craftcms",
"versions": [
{
"lessThan": "5.11.0",
"status": "affected",
"version": "5.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.0",
"versionStartIncluding": "5.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "@allblue"
},
{
"lang": "en",
"type": "coordinator",
"value": "Hackrate"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCraft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action\u0026nbsp;\u003ccode\u003eapp/render-components\u003c/code\u003e.\u003c/p\u003e\u003cp\u003eAny authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an\u0026nbsp;\u003ccode\u003eEntryType\u003c/code\u003e\u0026nbsp;object\u2019s\u0026nbsp;\u003ccode\u003euiLabelFormat\u003c/code\u003e\u0026nbsp;and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by\u0026nbsp;\u003ccode\u003erenderObjectTemplate()\u003c/code\u003e.\u003c/p\u003e\u003cp\u003eThis render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as\u0026nbsp;\u003ccode\u003esystem()\u003c/code\u003e, resulting in operating-system command execution with the privileges of the PHP/web-server process.\u003c/p\u003e\u003cp\u003eThe issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required.\u003c/p\u003e"
}
],
"value": "Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action\u00a0app/render-components.\n\n\n\nAny authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an\u00a0EntryType\u00a0object\u2019s\u00a0uiLabelFormat\u00a0and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by\u00a0renderObjectTemplate().\n\n\n\nThis render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as\u00a0system(), resulting in operating-system command execution with the privileges of the PHP/web-server process.\n\n\n\nThe issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336 Improper neutralization of special elements used in a template engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T10:23:25.037Z",
"orgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
"shortName": "Hackrate"
},
"references": [
{
"tags": [
"third-party-advisory",
"technical-description",
"mitigation"
],
"url": "https://www.hckrt.com/hacktivity/HCKRT-PVWH7W"
},
{
"tags": [
"release-notes"
],
"url": "https://github.com/craftcms/cms/releases/tag/5.11.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/craftcms/cms"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-g48f-wc2q-4rrv"
}
],
"source": {
"advisory": "GHSA-g48f-wc2q-4rrv",
"discovery": "UNKNOWN"
},
"title": "Authenticated RCE via render-components Entry Type overrides",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
"assignerShortName": "Hackrate",
"cveId": "CVE-2026-105985",
"datePublished": "2026-10-06T10:23:25.037Z",
"dateReserved": "2026-10-06T10:08:10.713Z",
"dateUpdated": "2026-10-07T03:55:21.500Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-79987 (GCVE-0-2026-79987)
Vulnerability from cvelistv5 – Published: 2026-09-10 16:05 – Updated: 2026-09-11 03:56
VLAI
EPSS
VEX
Title
Low-privilege RCE through element-search eager loading
Summary
A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 00:00 UTC
CWE
- CWE-470 - Use of Externally-Controlled input to select classes or code ('unsafe reflection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.hckrt.com/hacktivity/HCKRT-9TSYY2 | third-party-advisorytechnical-descriptionmitigation |
| https://github.com/craftcms/cms/releases/tag/5.10.13 | release-notes |
| https://github.com/craftcms/cms | product |
| https://github.com/craftcms/cms/security/advisori… | third-party-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-79987",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T03:56:46.336Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "craftcms/cms",
"product": "cms",
"vendor": "craftcms",
"versions": [
{
"lessThan": "5.10.13",
"status": "affected",
"version": "5.8.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.13",
"versionStartIncluding": "5.8.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "@CryptoCat"
},
{
"lang": "en",
"type": "coordinator",
"value": "Hackrate"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A remote, authenticated, non-admin Craft CMS Control Panel user with only the\u0026nbsp;\u003ccode\u003eaccessCp\u003c/code\u003e\u0026nbsp;permission can execute operating system commands as the PHP web worker.\u003cbr\u003e"
}
],
"value": "A remote, authenticated, non-admin Craft CMS Control Panel user with only the\u00a0accessCp\u00a0permission can execute operating system commands as the PHP web worker."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-470",
"description": "CWE-470 Use of Externally-Controlled input to select classes or code (\u0027unsafe reflection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T16:05:55.403Z",
"orgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
"shortName": "Hackrate"
},
"references": [
{
"tags": [
"third-party-advisory",
"technical-description",
"mitigation"
],
"url": "https://www.hckrt.com/hacktivity/HCKRT-9TSYY2"
},
{
"tags": [
"release-notes"
],
"url": "https://github.com/craftcms/cms/releases/tag/5.10.13"
},
{
"tags": [
"product"
],
"url": "https://github.com/craftcms/cms"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-9c4j-cjw3-r3xx"
}
],
"source": {
"advisory": "GHSA-9c4j-cjw3-r3xx",
"discovery": "UNKNOWN"
},
"title": "Low-privilege RCE through element-search eager loading",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
"assignerShortName": "Hackrate",
"cveId": "CVE-2026-79987",
"datePublished": "2026-09-10T16:05:55.403Z",
"dateReserved": "2026-08-25T16:39:03.170Z",
"dateUpdated": "2026-09-11T03:56:46.336Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-79991 (GCVE-0-2026-79991)
Vulnerability from cvelistv5 – Published: 2026-09-02 14:25 – Updated: 2026-09-02 17:55
VLAI
EPSS
VEX
Title
Authenticated SQL Injection via nested eager-loading criteria
Summary
Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), which is the function that enforces site-scope filtering via array_intersect against the GraphQL schema’s allowed sites. The query path (ElementResolverprepareElementQuery) correctly calls prepareArguments()`, so queries to unauthorized sites return empty. But mutations bypass this entirely — an attacker with a token scoped to Site A can create, modify, or delete entries in Site B by passing siteId in the mutations argument.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 17:55 UTC
CWE
- CWE-89 - Improper neutralization of special elements used in an SQL command ('SQL injection')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.hckrt.com/hacktivity/HCKRT-B5BSMM | third-party-advisorytechnical-descriptionmitigation |
| https://github.com/craftcms/cms/releases/tag/5.10.13 | release-notes |
| https://github.com/craftcms/cms | product |
| https://github.com/craftcms/cms/security/advisori… | third-party-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-79991",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T17:55:06.910643Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T17:55:14.034Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "craftcms/cms",
"product": "cms",
"vendor": "craftcms",
"versions": [
{
"lessThan": "5.10.13",
"status": "affected",
"version": "5.0.0-RC1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.13",
"versionStartIncluding": "5.0.0-rc1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "@Uncle_cui233"
},
{
"lang": "en",
"type": "coordinator",
"value": "Hackrate"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Craft CMS GraphQL entry mutation resolvers (\u003ccode\u003esaveEntry\u003c/code\u003e,\u0026nbsp;\u003ccode\u003edeleteEntry) read\u0026nbsp;\u003c/code\u003esiteId\u003ccode\u003edirectly from\u003c/code\u003e$arguments\u003ccode\u003ewithout passing through\u003c/code\u003eArgumentManagerprepareArguments()\u003ccode\u003e, which is the function that enforces site-scope filtering via\u0026nbsp;\u003c/code\u003earray_intersect\u003ccode\u003e\u0026nbsp;against the GraphQL schema\u2019s allowed sites. The query path (\u003c/code\u003eElementResolverprepareElementQuery\u003ccode\u003e) correctly calls\u0026nbsp;\u003c/code\u003eprepareArguments()`, so queries to unauthorized sites return empty. But mutations bypass this entirely \u2014 an attacker with a token scoped to Site A can create, modify, or delete entries in Site B by passing siteId in the mutations argument.\u003cbr\u003e"
}
],
"value": "Craft CMS GraphQL entry mutation resolvers (saveEntry,\u00a0deleteEntry) read\u00a0siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), which is the function that enforces site-scope filtering via\u00a0array_intersect\u00a0against the GraphQL schema\u2019s allowed sites. The query path (ElementResolverprepareElementQuery) correctly calls\u00a0prepareArguments()`, so queries to unauthorized sites return empty. But mutations bypass this entirely \u2014 an attacker with a token scoped to Site A can create, modify, or delete entries in Site B by passing siteId in the mutations argument."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89 Improper neutralization of special elements used in an SQL command (\u0027SQL injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T14:25:15.221Z",
"orgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
"shortName": "Hackrate"
},
"references": [
{
"tags": [
"third-party-advisory",
"technical-description",
"mitigation"
],
"url": "https://www.hckrt.com/hacktivity/HCKRT-B5BSMM"
},
{
"tags": [
"release-notes"
],
"url": "https://github.com/craftcms/cms/releases/tag/5.10.13"
},
{
"tags": [
"product"
],
"url": "https://github.com/craftcms/cms"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-4mgp-5vf2-7c9m"
}
],
"source": {
"advisory": "GHSA-4mgp-5vf2-7c9m",
"discovery": "UNKNOWN"
},
"title": "Authenticated SQL Injection via nested eager-loading criteria",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
"assignerShortName": "Hackrate",
"cveId": "CVE-2026-79991",
"datePublished": "2026-09-02T14:25:15.221Z",
"dateReserved": "2026-08-25T16:39:03.171Z",
"dateUpdated": "2026-09-02T17:55:14.034Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-79990 (GCVE-0-2026-79990)
Vulnerability from cvelistv5 – Published: 2026-09-02 14:19 – Updated: 2026-09-02 17:53
VLAI
EPSS
VEX
Title
GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete
Summary
Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), which is the function that enforces site-scope filtering via array_intersect against the GraphQL schema’s allowed sites. The query path (ElementResolverprepareElementQuery) correctly calls prepareArguments()`, so queries to unauthorized sites return empty. But mutations bypass this entirely — an attacker with a token scoped to Site A can create, modify, or delete entries in Site B by passing siteId in the mutations argument.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 17:52 UTC
CWE
- CWE-639 - Authorization bypass through User-Controlled key
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.hckrt.com/hacktivity/HCKRT-XEQKMX | third-party-advisorytechnical-descriptionmitigation |
| https://github.com/craftcms/cms/releases/tag/5.10.11 | release-notes |
| https://github.com/craftcms/cms | product |
| https://github.com/craftcms/cms/security/advisori… | third-party-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-79990",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T17:52:53.038505Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T17:53:23.468Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "craftcms/cms",
"product": "cms",
"vendor": "craftcms",
"versions": [
{
"lessThan": "5.10.11",
"status": "affected",
"version": "5.0.0-RC1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.11",
"versionStartIncluding": "5.0.0-rc1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "@ddme"
},
{
"lang": "en",
"type": "coordinator",
"value": "Hackrate"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Craft CMS GraphQL entry mutation resolvers (\u003ccode\u003esaveEntry\u003c/code\u003e,\u0026nbsp;\u003ccode\u003edeleteEntry) read\u0026nbsp;\u003c/code\u003esiteId\u003ccode\u003edirectly from\u003c/code\u003e$arguments\u003ccode\u003ewithout passing through\u003c/code\u003eArgumentManagerprepareArguments()\u003ccode\u003e, which is the function that enforces site-scope filtering via\u0026nbsp;\u003c/code\u003earray_intersect\u003ccode\u003e\u0026nbsp;against the GraphQL schema\u2019s allowed sites. The query path (\u003c/code\u003eElementResolverprepareElementQuery\u003ccode\u003e) correctly calls\u0026nbsp;\u003c/code\u003eprepareArguments()`, so queries to unauthorized sites return empty. But mutations bypass this entirely \u2014 an attacker with a token scoped to Site A can create, modify, or delete entries in Site B by passing siteId in the mutations argument.\u003cbr\u003e"
}
],
"value": "Craft CMS GraphQL entry mutation resolvers (saveEntry,\u00a0deleteEntry) read\u00a0siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), which is the function that enforces site-scope filtering via\u00a0array_intersect\u00a0against the GraphQL schema\u2019s allowed sites. The query path (ElementResolverprepareElementQuery) correctly calls\u00a0prepareArguments()`, so queries to unauthorized sites return empty. But mutations bypass this entirely \u2014 an attacker with a token scoped to Site A can create, modify, or delete entries in Site B by passing siteId in the mutations argument."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization bypass through User-Controlled key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T14:19:54.892Z",
"orgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
"shortName": "Hackrate"
},
"references": [
{
"tags": [
"third-party-advisory",
"technical-description",
"mitigation"
],
"url": "https://www.hckrt.com/hacktivity/HCKRT-XEQKMX"
},
{
"tags": [
"release-notes"
],
"url": "https://github.com/craftcms/cms/releases/tag/5.10.11"
},
{
"tags": [
"product"
],
"url": "https://github.com/craftcms/cms"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-3wcr-p33w-528f"
}
],
"source": {
"advisory": "GHSA-3wcr-p33w-528f",
"discovery": "UNKNOWN"
},
"title": "GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
"assignerShortName": "Hackrate",
"cveId": "CVE-2026-79990",
"datePublished": "2026-09-02T14:19:54.892Z",
"dateReserved": "2026-08-25T16:39:03.171Z",
"dateUpdated": "2026-09-02T17:53:23.468Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-79989 (GCVE-0-2026-79989)
Vulnerability from cvelistv5 – Published: 2026-09-02 14:11 – Updated: 2026-09-02 17:51
VLAI
EPSS
VEX
Title
Arbitrary user password reset leading to administrator account takeover
Summary
The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission (which doesn’t allow changing others’ passwords) and lacks Administrate users permission (which is required to change others’ passwords).
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-02 17:51 UTC
CWE
- CWE-285 - Improper Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.hckrt.com/hacktivity/HCKRT-ZDSZJH | third-party-advisorytechnical-descriptionmitigation |
| https://github.com/craftcms/cms/releases/tag/5.10.8 | release-notes |
| https://github.com/craftcms/cms | product |
| https://github.com/advisories/GHSA-p8x7-9vfw-p7vc | third-party-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-79989",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-02T17:51:36.553736Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T17:51:42.963Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "craftcms/cms",
"product": "cms",
"vendor": "craftcms",
"versions": [
{
"lessThan": "5.10.8",
"status": "affected",
"version": "5.0.0-RC1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.8",
"versionStartIncluding": "5.0.0-rc1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Mohammed Hesham (@he4am)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Hackrate"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users\u2019 passwords if the attacker\u2019s account has\u0026nbsp;\u003ccode\u003eEdit users\u003c/code\u003e\u0026nbsp;permission (which doesn\u2019t allow changing others\u2019 passwords) and lacks\u0026nbsp;\u003ccode\u003eAdministrate users\u003c/code\u003e\u0026nbsp;permission (which is required to change others\u2019 passwords).\u003cbr\u003e"
}
],
"value": "The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users\u2019 passwords if the attacker\u2019s account has\u00a0Edit users\u00a0permission (which doesn\u2019t allow changing others\u2019 passwords) and lacks\u00a0Administrate users\u00a0permission (which is required to change others\u2019 passwords)."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285 Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-02T14:11:02.784Z",
"orgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
"shortName": "Hackrate"
},
"references": [
{
"tags": [
"third-party-advisory",
"technical-description",
"mitigation"
],
"url": "https://www.hckrt.com/hacktivity/HCKRT-ZDSZJH"
},
{
"tags": [
"release-notes"
],
"url": "https://github.com/craftcms/cms/releases/tag/5.10.8"
},
{
"tags": [
"product"
],
"url": "https://github.com/craftcms/cms"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/advisories/GHSA-p8x7-9vfw-p7vc"
}
],
"source": {
"advisory": "GHSA-p8x7-9vfw-p7vc",
"discovery": "UNKNOWN"
},
"title": "Arbitrary user password reset leading to administrator account takeover",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
"assignerShortName": "Hackrate",
"cveId": "CVE-2026-79989",
"datePublished": "2026-09-02T14:11:02.784Z",
"dateReserved": "2026-08-25T16:39:03.171Z",
"dateUpdated": "2026-09-02T17:51:42.963Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-79988 (GCVE-0-2026-79988)
Vulnerability from cvelistv5 – Published: 2026-08-27 15:36 – Updated: 2026-08-28 16:51
VLAI
EPSS
VEX
Title
Authenticated RCE through Twig sandbox escape
Summary
The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 03:55 UTC
CWE
- CWE-693 - Protection Mechanism Failure
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.hckrt.com/hacktivity/HCKRT-8RQQ7K | third-party-advisorytechnical-descriptionmitigation |
| https://github.com/craftcms/cms/releases/tag/5.10.7 | release-notes |
| https://github.com/craftcms/cms | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-79988",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T03:55:36.964723Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T16:51:38.368Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "craftcms/cms",
"product": "cms",
"vendor": "craftcms",
"versions": [
{
"lessThan": "4.18.3",
"status": "affected",
"version": "4.0.0-RC1",
"versionType": "semver"
},
{
"lessThan": "5.10.7",
"status": "affected",
"version": "5.0.0-RC1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.18.3",
"versionStartIncluding": "4.0.0-rc1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.7",
"versionStartIncluding": "5.0.0-rc1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Oskar Zeino-Mahmalat (@oskar-cure53)"
},
{
"lang": "en",
"type": "coordinator",
"value": "Hackrate"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities.\u003cbr\u003e"
}
],
"value": "The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-693",
"description": "CWE-693 Protection Mechanism Failure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T15:36:18.188Z",
"orgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
"shortName": "Hackrate"
},
"references": [
{
"tags": [
"third-party-advisory",
"technical-description",
"mitigation"
],
"url": "https://www.hckrt.com/hacktivity/HCKRT-8RQQ7K"
},
{
"tags": [
"release-notes"
],
"url": "https://github.com/craftcms/cms/releases/tag/5.10.7"
},
{
"tags": [
"product"
],
"url": "https://github.com/craftcms/cms"
}
],
"source": {
"advisory": "GHSA-F5WM-88JV-G5HX",
"discovery": "UNKNOWN"
},
"title": "Authenticated RCE through Twig sandbox escape",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
"assignerShortName": "Hackrate",
"cveId": "CVE-2026-79988",
"datePublished": "2026-08-27T15:36:18.188Z",
"dateReserved": "2026-08-25T16:39:03.171Z",
"dateUpdated": "2026-08-28T16:51:38.368Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78416 (GCVE-0-2026-78416)
Vulnerability from cvelistv5 – Published: 2026-08-24 15:36 – Updated: 2026-08-26 20:59
VLAI
EPSS
VEX
Title
Authenticated RCE via `condition.config` JSON cleanse bypass
Summary
Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 00:00 UTC
CWE
- CWE-915 - Improperly controlled modification of Dynamically-Determined object attributes
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://www.hckrt.com/hacktivity/HCKRT-JD662P | third-party-advisorytechnical-descriptionmitigation |
| https://github.com/craftcms/cms/releases/tag/5.10.6 | release-notes |
| https://github.com/craftcms/cms | product |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78416",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T03:56:39.218Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "craftcms/cms",
"product": "cms",
"vendor": "craftcms",
"versions": [
{
"lessThan": "4.18.2",
"status": "affected",
"version": "4.0.0-RC1",
"versionType": "semver"
},
{
"lessThan": "5.10.6",
"status": "affected",
"version": "5.0.0-RC1",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.18.2",
"versionStartIncluding": "4.0.0-rc1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.6",
"versionStartIncluding": "5.0.0-rc1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "saladin"
},
{
"lang": "en",
"type": "coordinator",
"value": "Hackrate"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user.\u003cbr\u003e"
}
],
"value": "Craft CMS versions from 4.0.0-RC1 before 4.18.2 and from 5.0.0-RC1 before 5.10.6 contain an authenticated remote code execution vulnerability in control panel element-search condition handling. A JSON cleanse bypass in condition.config allows Yii behavior/event configuration keys to be interpreted after decoding, enabling command execution as the PHP/web user."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 Code Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-915",
"description": "CWE-915 Improperly controlled modification of Dynamically-Determined object attributes",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T20:59:03.683Z",
"orgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
"shortName": "Hackrate"
},
"references": [
{
"tags": [
"third-party-advisory",
"technical-description",
"mitigation"
],
"url": "https://www.hckrt.com/hacktivity/HCKRT-JD662P"
},
{
"tags": [
"release-notes"
],
"url": "https://github.com/craftcms/cms/releases/tag/5.10.6"
},
{
"tags": [
"product"
],
"url": "https://github.com/craftcms/cms"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Authenticated RCE via `condition.config` JSON cleanse bypass",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
"assignerShortName": "Hackrate",
"cveId": "CVE-2026-78416",
"datePublished": "2026-08-24T15:36:07.971Z",
"dateReserved": "2026-08-24T15:07:04.075Z",
"dateUpdated": "2026-08-26T20:59:03.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2345 (GCVE-0-2026-2345)
Vulnerability from cvelistv5 – Published: 2026-02-11 14:49 – Updated: 2026-02-11 21:19
VLAI
EPSS
VEX
Title
Insufficient Origin Validation in Proctorio Chrome Extension postMessage Handlers
Summary
Proctorio Chrome Extension is a browser extension used for online proctoring. The extension contains multiple window.addEventListener('message', ...) handlers that do not properly validate the origin of incoming messages. Specifically, an internal messaging bridge processes messages based solely on the presence of a fromWebsite property without verifying the event.origin attribute.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-11 21:19 UTC
CWE
- CWE-346 - Origin Validation Error
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Proctorio | Secure Exam Proctor Extension |
Affected:
1.5.25220.33
Unaffected: 1.5.25220.36 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-2345",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-11T21:19:02.758590Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-11T21:19:08.551Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Secure Exam Proctor Extension",
"vendor": "Proctorio",
"versions": [
{
"status": "affected",
"version": "1.5.25220.33"
},
{
"status": "unaffected",
"version": "1.5.25220.36"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Caen Jones (@vcc3v)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eProctorio Chrome Extension is a browser extension used for online proctoring. The extension contains multiple window.addEventListener(\u0027message\u0027, ...) handlers that do not properly validate the origin of incoming messages. Specifically, an internal messaging bridge processes messages based solely on the presence of a fromWebsite property without verifying the event.origin attribute.\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "Proctorio Chrome Extension is a browser extension used for online proctoring. The extension contains multiple window.addEventListener(\u0027message\u0027, ...) handlers that do not properly validate the origin of incoming messages. Specifically, an internal messaging bridge processes messages based solely on the presence of a fromWebsite property without verifying the event.origin attribute."
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.6,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346 Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-11T14:49:44.991Z",
"orgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
"shortName": "Hackrate"
},
"references": [
{
"url": "https://www.hckrt.com/hacktivity/46b61f36-b685-4667-aebf-82a67ad69ad6"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Insufficient Origin Validation in Proctorio Chrome Extension postMessage Handlers",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
"assignerShortName": "Hackrate",
"cveId": "CVE-2026-2345",
"datePublished": "2026-02-11T14:49:44.991Z",
"dateReserved": "2026-02-11T14:45:32.162Z",
"dateUpdated": "2026-02-11T21:19:08.551Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}