CVE-2026-84797: Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate
Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate() that allows authenticated users with createEntries permission to delete peer provisional drafts. Attackers can exploit the deleteProvisionalDraft parameter to delete another user's unsaved draft without proper authorization checks, gaining access to the victim's in-progress content.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.10.11 - Compensating control
Restrict access so that only authorized users can invoke the vulnerable controller action Duplicate (ElementsController::actionDuplicate()), limiting authenticated users to the minimum required permissions (e.g., avoid granting createEntries if not necessary) until Craft CMS is upgraded to 5.10.11.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have the createEntries permission. The issue enables such a user to target provisional drafts belonging to peer users.
What does an attacker need to do to trigger the vulnerability?
The attacker uses the actionDuplicate functionality with the deleteProvisionalDraft parameter. The affected authorization checks do not properly prevent deletion of another user's unsaved provisional draft.
Which deployments are affected?
Craft CMS versions from 5.0.0-RC1 through versions before 5.10.11 are affected. The provided data does not identify any configuration prerequisite beyond an authenticated account with createEntries permission.
How can an organization determine whether it may have been affected?
Review whether the deployed Craft CMS version is earlier than 5.10.11 and identify accounts granted createEntries permission. Investigate unexpected deletion or loss of users' unsaved provisional drafts, particularly where another authenticated user could have accessed the duplicate action.