5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-28782

CVE-2026-28782: Craft has a Permission Bypass and IDOR in Duplicate Entry Action

Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, the "Duplicate" entry action does not properly verify if the user has permission to perform this action on the specific target elements. Even with only "View Entries" permission (where the "Duplicate" action is restricted in the UI), a user can bypass this restriction by sending a direct request. Furthermore, this vulnerability allows duplicating other users' entries by specifying their Entry IDs. Since Entry IDs are incremental, an attacker can trivially brute-force these IDs to duplicate and access restricted content across the system. This vulnerability is fixed in 5.9.0-beta.1 and 4.17.0-beta.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-28782

CVE-2026-28782:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/cms	composer	>= 5.0.0-RC1, < 5.9.0-beta.1	5.9.0-beta.1
craftcms/cms	composer	>= 4.0.0-RC1, < 4.17.0-beta.1	4.17.0-beta.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because the 'Duplicate' element action in Craft CMS failed to verify user permissions before duplicating an entry. The analysis of the patch commit fb61a91357f5761c852400185ba931f51d82783d reveals the exact location of the flaw. The file src/elements/actions/Duplicate.php was modified to add a permission check. Specifically, the _duplicateElements method, which handles the duplication logic, was missing a check to see if the user was authorized to duplicate the specified element. The patch introduced a call to $elementsService->canDuplicate($element, $user) for each element before duplication. The public method performAction calls _duplicateElements, making it the entry point for the exploitation of this vulnerability. An attacker could send a crafted request to the admin/actions/element-indexes/perform-action endpoint, which would trigger performAction on the Duplicate action class, and duplicate entries they are not supposed to have access to. The commit also patched similar authorization flaws in DeleteUsers, Restore, and SetStatus actions, indicating a broader pattern of missing permission checks.

Vulnerable functions

craft\elements\actions\Duplicate::_duplicateElements

src/elements/actions/Duplicate.php

This private method contains the core logic for duplicating elements. Prior to the patch, it iterated through elements and duplicated them without verifying if the user performing the action had the necessary permissions to do so. This allowed a user with limited privileges to duplicate any entry by providing its ID, leading to an Insecure Direct Object Reference (IDOR) and information disclosure.

craft\elements\actions\Duplicate::performAction

src/elements/actions/Duplicate.php

As the public entry point for the 'Duplicate' action, this function is what an attacker's request would invoke. It receives the element IDs to be duplicated and passes them to the `_duplicateElements` method. Although the flaw is not directly in this function's code, it is the function that initiates the vulnerable workflow, making it a key part of the exploit chain.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.