CVE-2026-50281: Craft CMS's mass assignment via id in newAttributes during bulk duplicate overwrites existing elements

July 2, 2026

There is a mass-assignment flaw in the bulk-duplicate element action. Alice, holding only the permission to duplicate an entry she owns, submits an arbitrary id through the newAttributes request parameter. The duplication routine overrides its own id = null reset with that value and writes Alice’s attributes into Bob’s existing entry row.

References

github.com/advisories/GHSA-x5m4-g2cq-52pq
github.com/craftcms/cms/commit/8f6587c25050bbb6e080d59c71f6bb8932fc8600
github.com/craftcms/cms/security/advisories/GHSA-x5m4-g2cq-52pq
nvd.nist.gov/vuln/detail/CVE-2026-50281

Code Behaviors & Features

Detect and mitigate CVE-2026-50281 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →