Vulnerability · Published Sep 2, 2026 · Assigned by VulnCheck
CVE-2026-84794Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset
High 7.1
In plain English
A high-severity missing authorization in cms from craftcms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.4%top 71.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files, allowing unauthorized asset deletion and replacement.
Affected products (as reported)
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
References
- GitHub Security Advisory (GHSA-9xvf-7w97-83mv) vendor-advisory
- VulnCheck Advisory: Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset third-party-advisory