[MEDIUM] Craft CMS: Authorization bypass in `entries/move-to-section` via missing target-section save check

PKSA-nhns-q2yx-ct2v CVE-2026-50280 GHSA-43cq-c2gq-pfpw

Affected package: craftcms/cms

Affected version: >=5.0.0-RC1,<5.9.21

Reported by:
GitHub