CVE-2026-84794: Missing Authorization in craftcms cms

CVE-2026-84794 describes a missing authorization vulnerability in Craft CMS prior to version 5.10.11. Specifically, the assets/move-asset endpoint does not properly verify user permissions when the force=1 parameter is supplied. This flaw permits authenticated users with limited privileges to move their own assets into folders owned by other users and to forcibly delete files that conflict with the move operation. The vulnerability enables unauthorized deletion and replacement of assets, potentially impacting data integrity and user content management.

The vulnerability allows authenticated users without peer asset permissions to delete or replace assets in other users' folders by exploiting the missing authorization check. This can lead to unauthorized data modification and loss of assets, affecting the integrity and availability of user content within the CMS.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor vendor communications for updates. Until a fix is available, restrict access to the assets/move-asset endpoint and review user permissions to minimize risk.