deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-f582-6gf6-gx4g
Package: craftcms/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-285: Improper Authorization, CWE-862: Missing Authorization
Vulnerable versions: >= 5.3.0, <= 5.9.13
Patched in: 5.9.14

Summary: Craft CMS has an authorization bypass which allows any control panel user to move entries without permissions

Details:
### Summary

An authenticated control panel user with only accessCp can move entries across sections via POST `/actions/entries/move-to-section`, even when they do not have `saveEntries:{sectionUid}` permission for either source or destination section.

### Details

#### Root-cause analysis

  1. actionMoveToSection accepts sectionId and entryIds, loads entries, and iterates:
`Craft::$app->getEntries()->moveEntryToSection($entry, $section)`.
  2. The endpoint does not enforce per-entry or per-section authorization checks.
  3. `moveEntryToSection()` also does not enforce current-user authorization.
  4. There is a permission check in `actionMoveToSectionModalData` for building UI options, but that check is not enforced in the actual endpoint.
  5. Therefore, a direct POST request can bypass UI filtering and perform unauthorized entry moves.

 ### Impact

* This is an authorization bypass permitting unauthorized content changes.
* Authenticated low-privileged control panel users can move entries they should not be able to manage, violating integrity and potentially disrupting routing/editorial controls.
GitHub Security Advisory: GHSA-vgjg-248p-rfm2
Package: craftcms/cms (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-862: Missing Authorization
Vulnerable versions: >= 4.0.0-RC1, <= 4.17.7
Patched in: 4.17.8

Summary: Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users

Details:
### Summary

A low-privileged authenticated user can call `assets/image-editor` with the ID of a private asset they cannot view and still receive editor response data, including `focalPoint`.

The endpoint returns private editing metadata without per-asset authorization validation.

Root-cause analysis:

1. `actionImageEditor()` accepts `assetId` from the request body.
2. The asset is loaded, and the focal-point data is read.
3. Response returns `html` and `focalPoint`.
4. No explicit authorization check is applied before the response.

### Impact

## Affected deployments:

* Craft sites where asset edit metadata should remain restricted to authorized users.

## Security consequence:

* Unauthorized users can extract private editor metadata and related editor context for inaccessible assets.
GitHub Security Advisory: GHSA-vgjg-248p-rfm2
Package: craftcms/cms (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-862: Missing Authorization
Vulnerable versions: >= 5.0.0-RC1, <= 5.9.13
Patched in: 5.9.14

Summary: Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users

Details:
### Summary

A low-privileged authenticated user can call `assets/image-editor` with the ID of a private asset they cannot view and still receive editor response data, including `focalPoint`.

The endpoint returns private editing metadata without per-asset authorization validation.

Root-cause analysis:

1. `actionImageEditor()` accepts `assetId` from the request body.
2. The asset is loaded, and the focal-point data is read.
3. Response returns `html` and `focalPoint`.
4. No explicit authorization check is applied before the response.

### Impact

## Affected deployments:

* Craft sites where asset edit metadata should remain restricted to authorized users.

## Security consequence:

* Unauthorized users can extract private editor metadata and related editor context for inaccessible assets.
GitHub Security Advisory: GHSA-5pgf-h923-m958
Package: craftcms/cms (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key, CWE-862: Missing Authorization
Vulnerable versions: >= 4.0.0-RC1, <= 4.17.7
Patched in: 4.17.8

Summary: Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL

Details:
### Summary

An unauthenticated user can call `assets/generate-transform` with a private `assetId`, receive a valid transform URL, and fetch transformed image bytes.

The endpoint is anonymous and does not enforce per-asset authorization before returning the transform URL.

### Details

Root cause:
- Anonymous endpoint accepts user-controlled asset reference.
- It creates and returns a transform URL for that asset without checking access rights.
- If the transform output is reachable, guest users can read content derived from private assets.

Who is impacted:

- Installations where private source assets can be transformed and transform URLs are reachable.

Security consequence:

  - Anonymous users can obtain content derived from private assets without authentication.

### Resources

https://github.com/craftcms/cms/commit/7290d91639e
GitHub Security Advisory: GHSA-5pgf-h923-m958
Package: craftcms/cms (COMPOSER)
Severity: LOW (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key, CWE-862: Missing Authorization
Vulnerable versions: >= 5.0.0-RC1, <= 5.9.13
Patched in: 5.9.14

Summary: Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL

Details:
### Summary

An unauthenticated user can call `assets/generate-transform` with a private `assetId`, receive a valid transform URL, and fetch transformed image bytes.

The endpoint is anonymous and does not enforce per-asset authorization before returning the transform URL.

### Details

Root cause:
- Anonymous endpoint accepts user-controlled asset reference.
- It creates and returns a transform URL for that asset without checking access rights.
- If the transform output is reachable, guest users can read content derived from private assets.

Who is impacted:

- Installations where private source assets can be transformed and transform URLs are reachable.

Security consequence:

  - Anonymous users can obtain content derived from private assets without authentication.

### Resources

https://github.com/craftcms/cms/commit/7290d91639e
GitHub Security Advisory: GHSA-6mrr-q3pj-h53w
Package: craftcms/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-306: Missing Authentication for Critical Function, CWE-862: Missing Authorization
Vulnerable versions: >= 4.0.0-RC1, <= 4.17.7
Patched in: 4.17.8

Summary: Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations

Details:
### Summary
Guest users can access Config Sync updater `index`, obtain signed `data`, and execute state-changing Config Sync actions (`regenerate-yaml`, `apply-yaml-changes`) without authentication.

### Details

`ConfigSyncController` extends `BaseUpdaterController`, and the base updater is anonymously accessible for control panel requests.  `index` emits signed updater state (`data`), which can be reused by guests in subsequent requests.

Sensitive actions that are reachable via this method are `actionApplyYamlChanges`, `actionRegenerateYaml`, `applyExternalChanges`, and  `regenerateExternalConfig`.

#### Reproduction steps

1. Guest POST to:

    http POST /admin/actions/config-sync/index

  2. Extract data from returned JS state:

    Craft.updater = ... setState({"data":"<signedData>", ...});

  3. Reuse data as a guest:

```
  POST /admin/actions/config-sync/regenerate-yaml
  data=<signedData>&<csrfParam>=<csrfToken>
```

  or

```
  POST /admin/actions/config-sync/apply-yaml-changes
  data=<signedData>&<csrfParam>=<csrfToken>
```

  4. Observe completed response and state/file changes.

### Impact

Unauthenticated users can execute project configuration sync operations that should be restricted to trusted admin/deployment contexts.

Depending on the pending YAML/config state, this can cause unauthorized config state transitions and a service integrity risk.

### Resources

https://github.com/craftcms/cms/commit/7f0ead833f7
GitHub Security Advisory: GHSA-6mrr-q3pj-h53w
Package: craftcms/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-306: Missing Authentication for Critical Function, CWE-862: Missing Authorization
Vulnerable versions: >= 5.0.0-RC1, <= 5.9.13
Patched in: 5.9.14

Summary: Craft CMS: Unauthenticated Users Can Perform Restricted Project Config Sync Operations

Details:
### Summary
Guest users can access Config Sync updater `index`, obtain signed `data`, and execute state-changing Config Sync actions (`regenerate-yaml`, `apply-yaml-changes`) without authentication.

### Details

`ConfigSyncController` extends `BaseUpdaterController`, and the base updater is anonymously accessible for control panel requests.  `index` emits signed updater state (`data`), which can be reused by guests in subsequent requests.

Sensitive actions that are reachable via this method are `actionApplyYamlChanges`, `actionRegenerateYaml`, `applyExternalChanges`, and  `regenerateExternalConfig`.

#### Reproduction steps

1. Guest POST to:

    http POST /admin/actions/config-sync/index

  2. Extract data from returned JS state:

    Craft.updater = ... setState({"data":"<signedData>", ...});

  3. Reuse data as a guest:

```
  POST /admin/actions/config-sync/regenerate-yaml
  data=<signedData>&<csrfParam>=<csrfToken>
```

  or

```
  POST /admin/actions/config-sync/apply-yaml-changes
  data=<signedData>&<csrfParam>=<csrfToken>
```

  4. Observe completed response and state/file changes.

### Impact

Unauthenticated users can execute project configuration sync operations that should be restricted to trusted admin/deployment contexts.

Depending on the pending YAML/config state, this can cause unauthorized config state transitions and a service integrity risk.

### Resources

https://github.com/craftcms/cms/commit/7f0ead833f7
GitHub Security Advisory: GHSA-3pvf-vxrv-hh9c
Package: craftcms/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: >= 5.0.0-RC1, <= 5.9.13
Patched in: 5.9.14

Summary: Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)

Details:
### Summary

A low-privileged authenticated user can read private asset content by calling `assets/edit-image` with an arbitrary `assetId` that they are not authorized to view.

The endpoint returns image bytes (or a preview redirect) without enforcing a per-asset view authorization check, leading to potential unauthorized disclosure of private files.

### Details

Root cause:
  - A user-controlled object reference (`assetId`) is used to load and return sensitive content.
  - The action does not verify whether the current user is authorized to view that asset.
  - This creates an authenticated IDOR / authorization bypass.

### Impact

- Craft installations where private/non-public assets exist and low-privileged users can authenticate.

## Resources

https://github.com/craftcms/cms/commit/7290d91639e
GitHub Security Advisory: GHSA-3pvf-vxrv-hh9c
Package: craftcms/cms (COMPOSER)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: >= 4.0.0-RC1, <= 4.17.7
Patched in: 4.17.8

Summary: Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)

Details:
### Summary

A low-privileged authenticated user can read private asset content by calling `assets/edit-image` with an arbitrary `assetId` that they are not authorized to view.

The endpoint returns image bytes (or a preview redirect) without enforcing a per-asset view authorization check, leading to potential unauthorized disclosure of private files.

### Details

Root cause:
  - A user-controlled object reference (`assetId`) is used to load and return sensitive content.
  - The action does not verify whether the current user is authorized to view that asset.
  - This creates an authenticated IDOR / authorization bypass.

### Impact

- Craft installations where private/non-public assets exist and low-privileged users can authenticate.

## Resources

https://github.com/craftcms/cms/commit/7290d91639e
GitHub Security Advisory: GHSA-2fph-6v5w-89hh
Package: craftcms/cms (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Vulnerable versions: >= 5.6.0, <= 5.9.12
Patched in: 5.9.13

Summary: Craft CMS is Vulnerable to Authenticated Remote Code Execution via Malicious Attached Behavior

Details:
## Summary

A Remote Code Execution (RCE) vulnerability exists in Craft CMS 5.x and 4.x that bypasses the security fixes for GHSA-7jx7-3846-m7w7 and GHSA-255j-qw47-wjh5. This vulnerability can be exploited by any authenticated user with control panel access.

The existing patches add `cleanseConfig()` to `assembleLayoutFromPost()` and various `FieldsController` actions to strip Yii2 behavior/event injection keys (`as ` and `on ` prefixed keys). However, the `fieldLayouts` parameter in `ElementIndexesController::actionFilterHud()` is passed directly to `FieldLayout::createFromConfig()` without any sanitization, enabling the same behavior injection attack chain.

## Impact

- **Attack Type**: Remote Code Execution (RCE)
- **Authentication Required**: Authenticated user with control panel access (`accessCp` permission)

## Vulnerability Details

### Root Cause

In `ElementIndexesController::actionFilterHud()` (line 493-494), the `fieldLayouts` body parameter is passed to `FieldLayout::createFromConfig()` without `cleanseConfig()`:

```php
// ElementIndexesController.php:485-494
if ($conditionConfig) {
    $conditionConfig = Component::cleanseConfig($conditionConfig); // conditionConfig IS cleansed
    $condition = $conditionsService->createCondition($conditionConfig);
} else {
    $condition = $this->elementType()::createCondition();
}

if (!empty($fieldLayouts)) {
    // fieldLayouts is NOT cleansed!
    $condition->setFieldLayouts(array_map(
        fn(array $config) => FieldLayout::createFromConfig($config),
        $fieldLayouts
    ));
}
```

Note the inconsistency: `conditionConfig` is sanitized with `cleanseConfig()`, but `fieldLayouts` is not.

### Attack Chain

1. Send a `fieldLayouts` array containing config with `"as <name>"` prefixed keys
2. `FieldLayout::createFromConfig($config)` -> `new self($config)` -> `Model::__construct($config)`
3. `App::configure($this, $config)` processes each key
4. `"as rce"` key -> `Component::__set("as rce", $value)` -> `Yii::createObject($value)` -> instantiates `AttributeTypecastBehavior` and attaches it to the FieldLayout
5. `"on *"` key -> registers a wildcard event handler
6. `parent::__construct()` -> `init()` -> `setTabs([])` -> `getAvailableNativeFields()` -> `trigger(EVENT_DEFINE_NATIVE_FIELDS)`
7. The wildcard handler fires -> `AttributeTypecastBehavior::beforeSave()` -> `typecastAttributes()`
8. `$this->owner->typecastBeforeSave` -> resolved via `Component::__get()` -> returns the command string from the behavior's own property
9. `call_user_func([ConsoleProcessus::class, 'execute'], $command)` -> `shell_exec($command)`

### Prerequisites

- A user account with control panel access
GitHub Security Advisory: GHSA-qr6x-wvxr-8hm9
Package: opensource-workshop/connect-cms (COMPOSER)
Severity: HIGH (CVSS 8.1)
CWE: CWE-285: Improper Authorization, CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: >= 2.0.0, <= 2.41.0
Patched in: 2.41.1

Summary: Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information

Details:
# Security Advisory — My Page Profile Update (Improper Authorization)

## Summary

An improper authorization issue in the My Page profile update feature may allow modification of arbitrary user information.

## Affected Versions

- 1.x series: <= 1.41.0
- 2.x series: <= 2.41.0

## Patched Versions

- 1.41.1
- 2.41.1

## Description

In part of the My Page profile update feature, another user's profile information or password could be modified. If exploited, arbitrary user accounts may be taken over. Exploitation requires that the attacker be able to reach the affected functionality as an authenticated user. Users affected by this vulnerability should update to a fixed version.

## Solution

Update to the fixed version.
For the 1.x series, update to 1.41.1 or later.
For the 2.x series, update to 2.41.1 or later.

## Credits

OpenSource WorkShops thanks **Sho Odagiri** (小田切 祥) of **GMO Cybersecurity by Ierae, Inc.** for reporting this vulnerability.
GitHub Security Advisory: GHSA-qr6x-wvxr-8hm9
Package: opensource-workshop/connect-cms (COMPOSER)
Severity: HIGH (CVSS 8.1)
CWE: CWE-285: Improper Authorization, CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: <= 1.41.0
Patched in: 1.41.1

Summary: Connect CMS: Improper Authorization in the My Page Profile Update Feature Allows Modification of Arbitrary User Information

Details:
# Security Advisory — My Page Profile Update (Improper Authorization)

## Summary

An improper authorization issue in the My Page profile update feature may allow modification of arbitrary user information.

## Affected Versions

- 1.x series: <= 1.41.0
- 2.x series: <= 2.41.0

## Patched Versions

- 1.41.1
- 2.41.1

## Description

In part of the My Page profile update feature, another user's profile information or password could be modified. If exploited, arbitrary user accounts may be taken over. Exploitation requires that the attacker be able to reach the affected functionality as an authenticated user. Users affected by this vulnerability should update to a fixed version.

## Solution

Update to the fixed version.
For the 1.x series, update to 1.41.1 or later.
For the 2.x series, update to 2.41.1 or later.

## Credits

OpenSource WorkShops thanks **Sho Odagiri** (小田切 祥) of **GMO Cybersecurity by Ierae, Inc.** for reporting this vulnerability.
GitHub Security Advisory: GHSA-62ch-j6x7-722j
Package: opensource-workshop/connect-cms (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-284: Improper Access Control
Vulnerable versions: >= 2.0.0, <= 2.40.0
Patched in: 2.41.1

Summary: Connect CMS: Information Disclosure Due to Improper Authorization through the Page Content Retrieval Feature

Details:
# Security Advisory — Page Content Retrieval (Improper Authorization)

## Summary

An improper authorization issue in the page content retrieval feature may allow retrieval of non-public information.

## Affected Versions

- 1.x series: <= 1.41.0
- 2.x series: <= 2.41.0

## Patched Versions

- 1.41.1
- 2.41.1

## Description

In part of the page content retrieval feature, insufficient authorization checks could allow processing associated with non-public pages to be executed. If exploited, the contents and attachments of non-public pages may be obtained by a third party. Users affected by this vulnerability should update to a fixed version.

## Solution

Update to the fixed version.
For the 1.x series, update to 1.41.1 or later.
For the 2.x series, update to 2.41.1 or later.

## Credits

OpenSource WorkShop thanks **Sho Odagiri** (小田切 祥) of **GMO Cybersecurity by Ierae, Inc.** for reporting this vulnerability.
GitHub Security Advisory: GHSA-62ch-j6x7-722j
Package: opensource-workshop/connect-cms (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-284: Improper Access Control
Vulnerable versions: <= 1.40.0
Patched in: 1.41.1

Summary: Connect CMS: Information Disclosure Due to Improper Authorization through the Page Content Retrieval Feature

Details:
# Security Advisory — Page Content Retrieval (Improper Authorization)

## Summary

An improper authorization issue in the page content retrieval feature may allow retrieval of non-public information.

## Affected Versions

- 1.x series: <= 1.41.0
- 2.x series: <= 2.41.0

## Patched Versions

- 1.41.1
- 2.41.1

## Description

In part of the page content retrieval feature, insufficient authorization checks could allow processing associated with non-public pages to be executed. If exploited, the contents and attachments of non-public pages may be obtained by a third party. Users affected by this vulnerability should update to a fixed version.

## Solution

Update to the fixed version.
For the 1.x series, update to 1.41.1 or later.
For the 2.x series, update to 2.41.1 or later.

## Credits

OpenSource WorkShop thanks **Sho Odagiri** (小田切 祥) of **GMO Cybersecurity by Ierae, Inc.** for reporting this vulnerability.
GitHub Security Advisory: GHSA-jh46-85jr-6ph9
Package: opensource-workshop/connect-cms (COMPOSER)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2.0.0, <= 2.41.0
Patched in: 2.41.1

Summary: Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin

Details:
# Security Advisory — Page Management Plugin (SSRF)

## Summary

A Server-Side Request Forgery (SSRF) issue exists in the external page migration feature of the Page Management Plugin.

## Affected Versions

- 1.x series: <= 1.41.0
- 2.x series: <= 2.41.0

## Patched Versions

- 1.41.1
- 2.41.1

## Description

In the external page migration feature of the Page Management Plugin, a Server-Side Request Forgery (SSRF) issue could occur. If exploited, it may allow access to internal destinations and could result in information disclosure. Exploitation requires privileges that allow use of the page management screen. Users affected by this vulnerability should update to a fixed version.

## Solution

Update to the fixed version.
For the 1.x series, update to 1.41.1 or later.
For the 2.x series, update to 2.41.1 or later.

## Credits

OpenSource WorkShop thanks **Sho Odagiri** (小田切 祥) of **GMO Cybersecurity by Ierae, Inc.** for reporting this vulnerability.
GitHub Security Advisory: GHSA-jh46-85jr-6ph9
Package: opensource-workshop/connect-cms (COMPOSER)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 1.41.0
Patched in: 1.41.1

Summary: Connect CMS has SSRF in the External Page Migration Feature of its Page Management Plugin

Details:
# Security Advisory — Page Management Plugin (SSRF)

## Summary

A Server-Side Request Forgery (SSRF) issue exists in the external page migration feature of the Page Management Plugin.

## Affected Versions

- 1.x series: <= 1.41.0
- 2.x series: <= 2.41.0

## Patched Versions

- 1.41.1
- 2.41.1

## Description

In the external page migration feature of the Page Management Plugin, a Server-Side Request Forgery (SSRF) issue could occur. If exploited, it may allow access to internal destinations and could result in information disclosure. Exploitation requires privileges that allow use of the page management screen. Users affected by this vulnerability should update to a fixed version.

## Solution

Update to the fixed version.
For the 1.x series, update to 1.41.1 or later.
For the 2.x series, update to 2.41.1 or later.

## Credits

OpenSource WorkShop thanks **Sho Odagiri** (小田切 祥) of **GMO Cybersecurity by Ierae, Inc.** for reporting this vulnerability.