Packagist/craftcms/cms CVE-2026-33162: medium, EPSS 0.39%

Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions

Action: Upgrade craftcms/cms to 5.9.14 or later.

composer require craftcms/cms:5.9.14

Affected

Fixed versions

Sources

• osv: GHSA-f582-6gf6-gx4g
• https://github.com/craftcms/cms/security/advisories/GHSA-f582-6gf6-gx4g
• https://nvd.nist.gov/vuln/detail/CVE-2026-33162
• https://github.com/craftcms/cms/commit/3c1ab1c4445dd9237855a66e6a06ecf3591a718e
• https://github.com/craftcms/cms
• https://github.com/craftcms/cms/releases/tag/5.9.14

CVE-2026-33162 · published 2026-03-24T17:28:40Z · modified 2026-03-25T21:19:13.690387Z · JSON