CVE-2026-84794: Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset
Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files, allowing unauthorized asset deletion and replacement.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.10.11
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated Craft CMS user who lacks permission over another user's assets can exploit it. The attacker must be able to submit requests to the assets/move-asset endpoint.
What condition triggers the authorization bypass?
The bypass occurs when the assets/move-asset request includes force=1. Under that condition, affected versions do not enforce authorization checks for peer assets.
What can an attacker do through this flaw?
They can move assets they own into folders belonging to other users and force deletion of conflicting files. This can result in unauthorized deletion and replacement of assets.
Which versions are affected and what version fixes it?
Craft CMS versions 5.0.0 through 5.10.10 are affected. Version 5.10.11 is the first version stated as not affected.