CVE-2026-84798: Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite
Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft (which only verifies draft ownership), then propagates the deletion to the canonical element without re-checking permissions. As a result, an authenticated user who has viewEntries, viewPeerEntries, saveEntries, savePeerEntries, and editSite permissions but lacks the deleteEntriesForSite permission can hard-delete a canonical entry's site record (and, for single-site entries, the full element and content), which is irrecoverable via Craft's recycle bin.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.10.11Patch Authorization Bypass via actionDeleteForSite - Compensating control
Restrict access to the Craft CMS endpoint that triggers ElementsController::actionDeleteForSite() so only users with the deleteEntriesForSite permission can reach it (e.g., via an application-level authorization gate or network/WAF controls that block unauthorized attempts).
Event History
Frequently Asked Questions
Which users are realistically able to exploit this issue?
An authenticated user needs viewEntries, viewPeerEntries, saveEntries, savePeerEntries, and editSite permissions. The issue affects users who have those permissions but do not have deleteEntriesForSite permission.
What is the impact of a successful exploit?
The user can hard-delete a canonical entry's site record. For single-site entries, this can delete the full element and its content, and the deletion cannot be recovered through Craft's recycle bin.
Are all affected Craft CMS deployments exposed by default?
Exposure depends on whether an authenticated user has the required view, save, and site-edit permissions while lacking deleteEntriesForSite. The provided information does not establish that this permission combination exists in a default configuration.
Which versions need remediation?
Craft CMS versions from 5.0.0-RC1 through versions before 5.10.11 are affected. Upgrading to 5.10.11 or later removes the affected version range.