CVE-2026-92589: Craft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder
Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries (but without savePeerEntries) opens another author's entry in read-only mode, Craft unconditionally grants that session a manageNestedElements::<ownerId>::field:<handle> authorization flag for the entry's Matrix/Address fields. Unlike the corresponding delete endpoint, actions/nested-elements/reorder trusts this session flag alone and never rechecks the caller's save permission for the owner element. As a result, a view-only user can POST to actions/nested-elements/reorder using the ownerElementType, ownerId, ownerSiteId, attribute, elementIds, and offset parameters present in the read-only page source and rewrite the sort order of Matrix blocks or Addresses belonging to content they are explicitly denied save access to.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.10.13
Event History
Frequently Asked Questions
Which users and content are exposed to this issue?
The issue affects authenticated Craft control panel users who have viewEntries and viewPeerEntries but do not have savePeerEntries. They can reorder Matrix blocks or Addresses on another author's entry that they may view but are explicitly not allowed to save.
What does an attacker need to exploit the issue?
The attacker needs an authenticated control panel account with the relevant view permissions and access to another author's entry in read-only mode. They can use parameters exposed in that page's source to submit a request to the nested-elements reorder action.
What can be changed through exploitation?
Exploitation permits changing the sort order of Matrix blocks or Addresses belonging to the other author's content. The provided information describes an integrity impact only; it does not indicate confidentiality or availability impact.
How can this be remediated?
Upgrade Craft CMS to version 5.10.13, which fixes the issue. The affected range is 5.0.0 through 5.10.12.