CVE-2026-50281 | Craft CMS up to 5.9.20 Request Parameter beforeAction _attributes dynamically-determined object attributes

SecurityVulns
Yanac

A vulnerability classified as critical has been found in Craft CMS up to 5.9.20. Affected by this vulnerability is the function ElementsController::beforeAction of the component Request Parameter Handler. Performing a manipulation of the argument _attributes results in dynamically-determined object attributes.

This vulnerability is cataloged as CVE-2026-50281. It is possible to initiate the attack remotely. There is no exploit available.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More