CVE-2026-28782: craftcms cms

Vulnerability summary

CVE-2026-28782 is a medium (CVSS 5.3) vulnerability in craftcms cms. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 04-03-2026
   PublishedVulnerability first disclosed.
2. 04-03-2026
   Last modifiedVulnerability information updated.

Description

Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, the "Duplicate" entry action does not properly verify if the user has permission to perform this action on the specific target elements. Even with only "View Entries" permission (where the "Duplicate" action is restricted in the UI), a user can bypass this restriction by sending a direct request. Furthermore, this vulnerability allows duplicating other users' entries by specifying their Entry IDs. Since Entry IDs are incremental, an attacker can trivially brute-force these IDs to duplicate and access restricted content across the system. This vulnerability is fixed in 5.9.0-beta.1 and 4.17.0-beta.1.

• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.