Security: craftcms/cms
Security Advisories
View information about security vulnerabilities from this repository's maintainers.
-
Arbitrary user password reset leading to administrator account takeoverGHSA-p8x7-9vfw-p7vc published
Jul 25, 2026 by angrybradHigh -
Stored XSS in the control panel via unescaped draft nameGHSA-2rp4-x2j7-qmcc published
Jul 25, 2026 by angrybradLow -
Broken access control: a non-admin can move/publish entries into sections they cannot editGHSA-ccpq-mw3m-wwg2 published
Aug 18, 2026 by angrybradModerate -
Stored XSS in site name rendered without escapingGHSA-5fjj-496j-2qqf published
Aug 18, 2026 by angrybradLow -
Authorization Bypass in assets/move-assetGHSA-9xvf-7w97-83mv published
Aug 18, 2026 by angrybradModerate -
Public registration inherits admin flag from deactivated admin accounts via missing guardGHSA-242m-9wq7-vhwq published
Aug 18, 2026 by angrybradModerate -
GQL entry mutation siteId bypasses schema site scope, enabling cross-site content read/write/deleteGHSA-3wcr-p33w-528f published
Aug 18, 2026 by angrybradHigh -
actionDuplicate with deleteProvisionalDraft side-effect deletes peer draftsGHSA-2f55-h4xr-92p2 published
Aug 18, 2026 by angrybradModerate -
actionDeleteForSite propagates deletion to canonical element without independent authorization checkGHSA-5fh8-74j8-mvcp published
Aug 18, 2026 by angrybradModerate -
PII disclosure with GraphQL native user relationsGHSA-4w9w-3x96-7ghp published
Aug 18, 2026 by angrybradModerate