Authorization Bypass in Craft CMS by Pixel & Tonic

CVE-2026-84794

What is CVE-2026-84794?

Craft CMS prior to version 5.10.11 is vulnerable due to a lack of proper authorization checks within the assets/move-asset endpoint when the force parameter is set to 1. This flaw allows authenticated users without the necessary permissions to move their assets into the folders of other users and potentially delete conflicting files, leading to unauthorized asset deletion and replacement. The implications can be severe, as it opens up avenues for malicious tampering with sensitive content.

References