CVE-2026-50281

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.7.0 through 5.9.20

Description A mass-assignment flaw exists in the bulk-duplicate element action. An attacker with permission to duplicate their own entries can overwrite other elements, such as entries, categories, or users, by submitting an arbitrary id through the newAttributes request parameter. While ElementsController::beforeAction() rejects id or canonicalId keys at the top level of a request, actionBulkDuplicate() passes the newAttributes array to the service layer without sufficient filtering. Specifically, Elements::duplicateElement() clones an element and sets its id to null, but Craft::configure() subsequently overwrites this reset with any numeric value provided in newAttributes. Consequently, the saveElement() function performs an UPDATE operation on the row matching the provided primary key instead of an INSERT, allowing the attacker to modify the title, slug, authorId, postDate, and UID of a victim's entry.

Recommendations Update Craft CMS to version 5.9.21.