7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28781

CVE-2026-28781: Craft Affected by Entries Authorship Spoofing via Mass Assignment

Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the entry creation process allows for Mass Assignment of the authorId attribute. A user with "Create Entries" permission can inject the authorIds[] (or authorId) parameter into the POST request, which the backend processes without verifying if the current user is authorized to assign authorship to others. Normally, this field is not present in the request for users without the necessary permissions. By manually adding this parameter, an attacker can attribute the new entry to any user, including Admins. This effectively "spoofs" the authorship. This vulnerability is fixed in 4.17.0-beta.1 and 5.9.0-beta.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28781

CVE-2026-28781:

7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/cms	composer	>= 5.0.0-RC1, < 5.9.0-beta.1	5.9.0-beta.1
craftcms/cms	composer	>= 4.0.0-RC1, < 4.17.0-beta.1	4.17.0-beta.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic mass assignment issue in Craft CMS, where the application allows a user to control the authorId attribute when creating or editing an entry, without proper authorization checks. The root cause is that controller actions were using a generic setAttributes method to populate element properties from the HTTP request.

My analysis of the provided patches (c6dcbdffaf6ab3ffe77d317336684d83699f4542 and 830b403870cd784b47ae42a3f5a16e7ac2d7f5a8) reveals the following:

Vulnerable Logic: The EntriesController::_populateEntryModel method explicitly shows the vulnerable logic where the author parameter is retrieved from the request and directly assigned to the entry's authorId. This is the primary function where the authorship spoofing occurs during entry creation.
Insecure Sink: The Entry::setAuthorId method acted as the insecure sink, as it would accept and set any authorId passed to it without question.
Introduction of a Secure Method: The fix introduces a new method, setAttributesFromRequest, which is specifically designed to handle attribute assignment from user requests. In the context of the Entry element, this new method overrides the parent implementation to add a crucial permission check (viewPeerEntries) before allowing a change to the authorId.
Widespread Pattern: The vulnerability was not isolated to a single controller. The patches show that other controllers like ElementsController and ElementIndexesController were also using the insecure setAttributes pattern. The fix involves replacing these calls with the new, more secure setAttributesFromRequest method.

Therefore, any function that would appear in a runtime profile during an exploit would involve the controller action that receives the request (e.g., EntriesController::_populateEntryModel, ElementIndexesController::actionSaveElements), which then leads to the insecure assignment via Entry::setAuthorId in the vulnerable versions.

Vulnerable functions

craft\controllers\EntriesController::_populateEntryModel

src/controllers/EntriesController.php

This private method was responsible for populating an Entry element with data from the request. The vulnerable code directly read the 'author' parameter from the POST body and assigned it to the entry's `authorId` property. There were no permission checks to verify if the logged-in user was authorized to assign authorship to another user, leading to an authorship spoofing vulnerability.

craft\elements\Entry::setAuthorId

src/elements/Entry.php

This setter method was the sink for the mass assignment vulnerability. It directly assigned the provided `$authorId` to the internal `_authorId` property without any validation or permission checks. An attacker could supply an arbitrary user ID through the request, which would then be passed to this function, effectively changing the author of the entry.

craft\controllers\ElementIndexesController::actionSaveElements

src/controllers/ElementIndexesController.php

This controller action handles bulk saving of elements from index pages. It was using the generic `setAttributes` method to apply changes from the request. This method did not perform the necessary security checks, allowing an attacker to inject and modify the `authorId` for multiple entries at once. The fix replaces the call with `setAttributesFromRequest`, which includes the required permission checks.

craft\controllers\ElementsController::actionCreate

src/controllers/ElementsController.php

This controller action is responsible for creating new elements. It was using the generic `setAttributes` method, which lacked the specific security checks needed for handling authorship. This allowed an attacker to perform a mass assignment attack and set the `authorId` during the element creation process. The patch mitigates this by calling the more secure `setAttributesFromRequest` method.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.