CVE-2026-84794 — Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset
Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can mo…
Published: 2026-09-02 · CVSS: 7.1 · CVSS 4.0
Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files, allowing unauthorized asset deletion and replacement.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7