CVE-2026-79987: Low-privilege RCE through element-search eager loading
Published Sep 10, 2026
·Updated
A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.
Affected Software
1 affected component
Craft CMS Craft CMS
Event History
Sep 10, 2026
CVE Published
via MITRE·04:05 PM
Data Sourced
via MITRE·04:05 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which accounts are exposed to this issue?
Any remote authenticated Craft CMS Control Panel account that is not an administrator but has the accessCp permission can exploit it. The issue does not require administrator privileges or user interaction.
2
What level of access can an attacker obtain?
An attacker can execute operating system commands as the PHP web worker. This can affect confidentiality, integrity, and availability of resources accessible to that worker.
3
Is an unauthenticated attacker able to exploit this?
No. Exploitation requires a remote authenticated Control Panel user with the accessCp permission.