THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-92589 (MEDIUM 4.3) — Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries (but without savePeerEntries) opens another author's entry in read-only

[NVD] CVE-2026-92589 (MEDIUM 4.3) — Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries (but without savePeerEntries) opens another author's entry in read-only

mednvdPublished 2026-09-16

CVE-2026-92589 CVSS: 4.3 MEDIUM Published: 2026-09-16T22:18:29.583

Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user with viewEntries and viewPeerEntries (but without savePeerEntries) opens another author's entry in read-only mode, Craft unconditionally grants that session a `m

MITRE ATT&CK techniques

Control PanelT1218.002

Indicators of compromise

CVE-2026-92589cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-92589