CVE-2026-50279

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.9.20

Description An authorship spoofing issue exists in the content management system. The theEntriesController::actionSaveEntry() function performs entry-edit permission checks before request-controlled author changes are applied to the model. The author mutation path accepts attacker-supplied authors or author parameters and allows the change if the current user is one of the previous authors. Since the controller does not re-verify authorization after mutating the author list, a low-privileged user can reassign an entry's authorship to another user without possessing the required peer-author-change permission.

Recommendations Update to version 5.9.21.