CVE-2026-84797: Missing Authorization in craftcms cms

CVE-2026-84797 describes an authorization bypass vulnerability in Craft CMS affecting versions prior to 5.10.11. The flaw exists in the ElementsController::actionDuplicate() method, where the deleteProvisionalDraft parameter can be manipulated by authenticated users who have createEntries permission to delete peer provisional drafts without proper authorization checks. This enables unauthorized deletion of another user's unsaved draft content, potentially exposing or disrupting in-progress content management.

The vulnerability allows authenticated users with createEntries permission to delete unsaved drafts of other users without authorization. This can lead to loss of in-progress content and unauthorized access to another user's draft data. The CVSS 4.0 base score is 5.3 (medium severity), indicating a moderate impact with network attack vector, low privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict createEntries permission to trusted users only to reduce risk. Monitor vendor communications for updates regarding a patch or official remediation.