Attack Chain

1. A low-privileged authenticated user crafts an HTTP POST request targeting the /entries/save-entry endpoint of a vulnerable Craft CMS instance.
2. The request includes parameters (authors or author) attempting to change the entry's author to a different user, for which the attacker does not hold explicit author-management permission.
3. The actionSaveEntry() function in EntriesController.php loads the target entry and performs initial edit permission checks based on the original entry state and the attacker's existing permissions (e.g., being an existing author of the entry).
4. The _populateEntryModel() helper function then processes the request, updating the entry model's authorIds attribute with the attacker-supplied values, critically before authorization for this specific author change is re-evaluated.
5. The canChangeAuthor() method is invoked and returns true because it evaluates against the old authorship state, where the current user is still considered one of the existing authors or meets other conditions like viewPeerEntries for the section.
6. The entry's author list is internally mutated within the model with the new, unauthorized authorIds provided by the attacker.
7. The controller proceeds without re-running comprehensive authorization checks on the new author assignment, assuming the initial check was sufficient.
8. The saveElement() and _saveAuthors() methods persist the altered author relationship to the database, resulting in the entry now appearing authored by the user specified by the attacker, effectively spoofing content ownership and compromising data integrity.

Impact

The successful exploitation of CVE-2026-50279 allows low-privileged users to falsify content ownership and alter the authorship of entries without possessing the dedicated author-management permission. This leads to several critical impacts including corrupted audit trails, where the true historical author of content is obscured, misleading notifications being sent to incorrect users, broken approval workflows as content changes may bypass designated reviewers, and unauthorized reassignment of content responsibility. This can severely undermine trust in the CMS content and its operational processes.

Recommendation

• Patch CVE-2026-50279 immediately by updating all Craft CMS installations to version 5.9.21 or later.
• Review application logs for the vulnerable /entries/save-entry (identified in IOCs) endpoint for unusual POST requests originating from low-privileged user accounts, especially those containing authors or author parameters, and investigate any successful changes in content ownership.