CVE-2026-31266

Craft CMS 5.9.5 and earlier contains a Missing Authorization vulnerability in the migrate endpoint (/actions/app/migrate).

CVSS v3.1

7.3 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS

0.28% chance of exploitation in the next 30 days, 20th percentile

Published

2026-05-27

Proof-of-concept exploits (2)

• 0xrixet/cms-security-poc0★ · 2026-06-05
• 0xrixet/Craftcms-PoC-CVE-2026-312660★ · 2026-06-05

References

• CVE Record
• NVD entry

Related

• CVE-2026-31156
• CVE-2026-31280
• CVE-2026-3102
• CVE-2026-31281
• CVE-2026-3101
• CVE-2026-31282