Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows…

What to know

What it is

Craft CMS versions 5.0.0 to 5.11.0 contain an authorization bypass vulnerability, allowing attackers to mutate content across sites. Attackers can create, delete, and modify entries, categories, tags, and assets on other sites.

Affected

{'products': ['Craft CMS'], 'packages': [], 'versions': ['5.0.0', '5.1.0', '5.2.0', '5.3.0', '5.4.0', '5.5.0', '5.6.0', '5.7.0', '5.8.0', '5.9.0', '5.10.0', '5.11.0']}

Fix

Upgrade to version 5.11.0 or later

Exploitation

No known exploitation

Not confirmed. 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.5.0, 5.6.0, 5.7.0, 5.8.0 isn't in the advisory. Check the vendor's advisory before acting on this.