External risk intelligence

Craft CMS Incorrect Authorization Vulnerability Affects Category Structures

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-72785

The vulnerability resides in the administrative control panel of a web-based content management system. While the control panel is typically restricted to authenticated users, it is a common, internet-accessible component of web application deployments, making it a reachable surface for an attacker who has obtained low-level administrative credentials.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in Craft CMS could allow unauthorized users to alter website navigation and internal linking structures by reorganizing content categories. Even users with only viewing permissions for categories can manipulate their order and hierarchy, potentially breaking website links and impacting user experience. The primary concern is confirming if your Craft CMS instances are affected and understanding the exposure.

Content changes impact website links.
Affects navigation and internal site structure.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this flaw by first gaining access to a Craft CMS control panel with limited permissions. Even without the ability to save changes to categories, an attacker can leverage the "structures/move-element" action to manipulate the category hierarchy. This manipulation can alter category URLs, potentially breaking navigation menus and corrupting the site's structure.

Authenticated control-panel access required.
Manipulating category order or hierarchy.
Corrupted navigation and broken category URLs.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact the organization and integrity of category structures within Craft CMS, potentially affecting website navigation and content accessibility when an authenticated user with limited permissions manipulates category data.

Category structure and URLs may be modified.
Navigation menus could break when categories are moved.
Content may become inaccessible or misplaced.

Operational Fix

Recommended remediation, mitigation, and detection steps

The described vulnerability in Craft CMS affects its category management functionality. Application owners and platform teams are likely responsible for managing this system. The first practical step is to identify all Craft CMS instances, determine their reachability and business criticality, and then confirm the accountable owner for remediation planning.

Application owners should lead the response.
Verify all Craft CMS instances and their reachability.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Craft CMS?

Craft CMS is a flexible content management system used to build and organize websites. It allows administrators to create complex content models, including category groups that define how information is structured. Developers and content managers use these structures to build navigation menus, organize taxonomies, and manage how pages relate to one another within the site's architecture.

What does this vulnerability mean for CVE-2026-72785?

This is an incorrect authorization vulnerability, categorized as CWE-863. It means the software fails to verify if a user has the proper permission level before performing a specific task. In this case, the system mistakenly allows a user with read-only access to modify the actual structure of categories, a privilege that should be reserved for users with explicit save permissions.

How is this vulnerability triggered?

An attacker must have existing access to the Craft CMS control panel as an authenticated user. The bug is triggered when that user invokes the 'structures/move-element' action to reorder or re-parent categories. Importantly, this does not require administrative 'save' permissions to execute; simply having permission to view categories is enough for the system to incorrectly process the unauthorized structural change.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as an external risk because the vulnerability exists within the administrative control panel. While usually restricted to logged-in users, the control panel is often internet-accessible in many deployments. This makes the administrative interface a reachable surface for any attacker who has obtained even low-level credentials to log in.

What should I do if I run Craft CMS?

Begin by identifying all your deployed Craft CMS instances to understand which are reachable from the internet. Once you have an inventory, confirm the accountable owner for each site and verify their current version. Since this issue is resolved in version 5.10.6, your priority is to coordinate with the appropriate team to plan and execute an update to a patched version.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.