CVE-2026-31266

Craft CMS 5.9.5 and earlier contains a Missing Authorization vulnerability in the migrate endpoint (/actions/app/migrate).

CVSS v3.1 CNA

7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS

0.39% chance of exploitation in the next 30 days, 31st percentile

Published

2026-05-27

Proof-of-concept exploits (2)

• 0xrixet/cms-security-poc0★ · 2026-06-05
• 0xrixet/Craftcms-PoC-CVE-2026-312660★ · 2026-06-05

References

• CVE Record
• NVD entry