CVE-2026-50281

## Summary There is a mass-assignment flaw in the bulk-duplicate element action. Alice, holding only the permission to duplicate an entry she owns, submits an arbitrary `id` through the `newAttributes` request parameter. The duplication routine overrides its own `id = null` reset with that value and writes Alice’s attributes into Bob’s existing entry row. ## Details `ElementsController::beforeAction()` (`src/controllers/ElementsController.php:119-124`) pulls the request body into `$this->_attributes` and rejects requests that ship an `id` or `canonicalId` key at the top level: ```php $this->_attributes = $this->request->getBodyParams(); // No funny business if (isset($this->_attributes['id']) || isset($this->_attributes['canonicalId'])) { throw new BadRequestHttpException('Changing an element’s ID is not allowed.'); } ``` The check inspects only the top-level payload. `actionBulkDuplicate()` (`src/controllers/ElementsController.php:1708-1749`) reads a separate `newAttributes` array and passes it straight through to the service layer: ```php $elementInfo = $this->request->getRequiredBodyParam('elements'); $newAttributes = $this->request->getRequiredBodyParam('newAttributes'); ... $safeNewAttributes = Collection::make($newAttributes) ->only($element->safeAttributes()) ->all(); ... $newElement = $elementsService->duplicateElement( $element, $safeNewAttributes + $element::baseBulkDuplicateAttributes(), false, checkAuthorization: true, ); ``` `Elements::duplicateElement()` (`src/services/Elements.php:1814-1840`) clones the source element, sets `id` to null, and then hands the attacker's array to `Craft::configure()`: ```php $mainClone = clone $element; $mainClone->id = null; $mainClone->uid = StringHelper::UUID(); ... Craft::configure($mainClone, ArrayHelper::merge( $newAttributes, $siteAttributes[$mainClone->siteId] ?? [], )); ``` `Craft::configure()` overwrites the reset `id` with any numeric value inside `$newAttributes`.