Privilege Escalation Vulnerability in Craft CMS by Pixel & Tonic
CVE-2026-50284

7.1HIGH

Key Information:

Vendor

Craftcms

Status
Cms
Vendor
CVE Published:
1 July 2026

What is CVE-2026-50284?

Craft CMS, developed by Pixel & Tonic, has a security vulnerability stemming from improper permission checks during asset deletion operations. Specifically, the AssetsController::actionDeleteFolder() mistakenly permits a low-privilege user with folder-management rights to delete not just their own assets but also those uploaded by peers, thus bypassing the intended per-asset permission controls. This flaw exists in multiple versions of Craft CMS, and it poses a significant risk of asset loss within shared volumes. The vulnerability has been resolved in subsequent updates, specifically versions 4.17.15 and 5.9.22, which enforce the necessary permissions for enhanced security.

Affected Version(s)

cms =>= 5.0.0-RC1, < 5.9.22 < 5.0.0-RC1, 5.9.22

cms >= 4.0.0-RC1, < 4.17.15 < 4.0.0-RC1, 4.17.15

References

https://github.com/craftcms/cms/security/advisories/GHSA-...
x_refsource_CONFIRM
https://github.com/craftcms/cms/commit/b4e08977f0c9bdf002...
x_refsource_MISC

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.