CVE-2026-72785

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.10.5

Description An incorrect authorization issue exists where a control-panel user with only the viewCategories permission, but lacking the saveCategories permission, can permanently modify a category group's structure by reordering and re-parenting categories. This occurs because the structureEditable flag is incorrectly computed based on view permissions instead of save permissions, and the StructuresController authorizes the mutating action via the 'structures/move-element' endpoint without performing a save permission re-check. Since a category's URI is derived from its position in the structure, this action can change URLs for the category and its descendants, potentially corrupting navigation menus based on the category taxonomy.

Recommendations Update to version 5.10.6.