The vulnerability in Craft CMS affects the AssetsController::actionReplaceFile method, which replaces a target asset file using another existing asset as the source. When both assetId (target) and sourceAssetId (source) are provided, the permission check incorrectly only verifies replace permissions on the target asset, omitting delete permission checks on the source asset. Consequently, an authenticated user who can replace files in one volume can delete assets in another volume where they lack delete permissions, by supplying a sourceAssetId. This leads to unauthorized deletion of source assets, causing broken content references and potential data loss. The issue is resolved in Craft CMS versions 4.17.14 and 5.9.21.

An authenticated user with replace file permissions on one asset volume can delete assets in another volume without having delete permissions. This unauthorized deletion can cause broken content references and data loss within the CMS. The vulnerability undermines the authorization controls intended to protect asset deletion operations.

This vulnerability has been fixed in Craft CMS versions 4.17.14 and 5.9.21. Users should upgrade to these or later versions to remediate the issue. Patch status is confirmed by the vendor advisory. No additional mitigation is required once updated.