Smakarim

**Name of the Vulnerable Software and Affected Versions** Craft CMS versions 5.0.0-RC1 through 5.10.5 **Description** An incorrect authorization issue exists where a control-panel user with only the `viewCategories` permission, but lacking the `saveCategories` permission, can permanently modify a category group's structure by reordering and re-parenting categories. This occurs because the `structureEditable` flag is incorrectly computed based on view permissions instead of save permissions, and the `StructuresController` authorizes the mutating action via the 'structures/move-element' endpoint without performing a save permission re-check. Since a category's URI is derived from its position in the structure, this action can change URLs for the category and its descendants, potentially corrupting navigation menus based on the category taxonomy. **Recommendations** Update to version 5.10.6.

**Name of the Vulnerable Software and Affected Versions** Craft CMS versions 4.0.0-RC1 through 4.17.9 Craft CMS versions 5.0.0-RC1 through 5.9.9 **Description** Control panel users with the `utility:system-messages` permission can embed a file-reading payload into system email templates because the `dataUrl()` Twig function is included in the Twig sandbox allowlist. When these emails are dispatched, the server reads the specified file and returns its contents as a base64-encoded data URL within the email body. This allows for the exfiltration of the `.env` file, which contains sensitive information such as the database password, `CRAFT SECURITY KEY`, and third-party API keys. Access to the `CRAFT SECURITY KEY` allows an attacker to forge session tokens and achieve full administrative account takeover. **Recommendations** Update to version 4.18.0. Update to version 5.10.0.