CVE-2026-84794CWE-862broken-access-control

CVE-2026-84794

High · published September 2, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
27.6
In the wild
Unconfirmed
What it is

Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files, allowing unauthorized asset deletion and replacement.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00352 · 27.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-02T16:17Z
References (2)
https://github.com/craftcms/cms/security/advisories/GHSA-9xvf-7w97-83mv · [email protected]https://www.vulncheck.com/advisories/craft-cms-5.0.0-through-5.10.10-authorization-bypass-via-assets-move-asset · [email protected]
EPSS history
Timeline
  • 04 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 02 SEP 11:11Z
    Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset
    cvelistv5