Is CVE-2026-28781 actively exploited?

No active exploitation of CVE-2026-28781 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-28781 be exploited remotely?

Yes. CVE-2026-28781 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-28781?

CVE-2026-28781 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2026-28781

MEDIUM

CVE-2026-28781

CWE-639Published: March 4, 2026· Updated: Mar 5, 2026

6.5

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:11.1th

Official Description

Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the entry creation process allows for Mass Assignment of the authorId attribute. A user with "Create Entries" permission can inject the authorIds[] (or authorId) parameter into the POST request, which the backend processes without verifying if the current user is authorized to assign authorship to others. Normally, this field is not present in the request for users without the necessary permissions. By manually adding this parameter, an attacker can attribute the new entry to any user, including Admins. This effectively "spoofs" the authorship. This vulnerability is fixed in 4.17.0-beta.1 and 5.9.0-beta.1.

NVD Source

Technical Analysis

CVE-2026-28781 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 6.5.