PACKAGIST · AUGUST 2026 · EARLY WARNING

Craft CMS Authorization Bypass Vulnerability: Early Warning

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: HIGH
Affected component: composer/craftcms/cms (packagist)
Patched version: 5.10.6

GHSA-4HC4-QJFX-WJF3GHSA-XXPX-F366-4XPQ

An authorization bypass vulnerability has been reported in Craft CMS versions 5.0.0-RC1 through 5.10.5, allowing view-only users to modify category structures. Users of these versions should take immediate action.

What happened

An early warning has been issued regarding a critical vulnerability in Craft CMS. Versions 5.0.0-RC1 through 5.10.5 are reportedly affected by an authorization bypass issue. This vulnerability allows users with view-only permissions to modify category structures, which could lead to unauthorized changes in the content management system. The issue has been addressed in version 5.10.6.

The vulnerability was first flagged on August 11, 2026, and is tracked under the IDs GHSA-4HC4-QJFX-WJF3 and GHSA-XXPX-F366-4XPQ. It is classified as a critical CVE and has not yet been exploited in the wild. The affected component is composer/craftcms/cms with the reported affected versions being 5.0.0-RC1 through 5.10.5. The patched version is 5.10.6.

What to do about it

Immediately upgrade to Craft CMS version 5.10.6 or later to mitigate the risk of unauthorized modifications.
Review your Craft CMS installation to ensure that all users have the appropriate permissions and that no unauthorized changes have been made.
Monitor the primary sources for any updates or additional information regarding this vulnerability.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If composer/craftcms/cms is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

If you are using Craft CMS versions 5.0.0-RC1 through 5.10.5, you are affected by this vulnerability.

What should I do right now?

Upgrade to Craft CMS version 5.10.6 or later to address the vulnerability.

Is there an official fix available?

Yes, the vulnerability is fixed in Craft CMS version 5.10.6.

Sources

[GHSA-4hc4-qjfx-wjf3] Duplicate Advisory: Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element

Join the 0Day waitlist →

← Back to all threats