Craft CMS versions 5.9.5 and earlier contain a Missing Authorization vulnerability in the migrate endpoint (/actions/app/migrate). This vulnerability allows unauthorized access to migration functionality which could potentially lead to system compromise. The vulnerability has been assigned CVE-2026-31266 and affects multiple versions of the popular content management system. Proof-of-concept code has been made available demonstrating the vulnerability. Organizations using affected versions should prioritize patching to prevent potential exploitation.