CVE-2026-84794 in Craft CMS
Summary
by MITRE • 09/02/2026
Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files, allowing unauthorized asset deletion and replacement.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in Craft CMS versions prior to 5.10.11 represents a critical authorization bypass within the application's asset management subsystem. Specifically, the flaw resides in the assets/move-asset endpoint, which is designed to handle file relocation operations within the content management system's storage hierarchy. The core technical deficiency involves an insufficient check of user permissions when the force parameter is set to one. In standard operational contexts, this endpoint should validate that a requesting authenticated user possesses explicit permission not only to move their own assets but also to write into the target directory and manage files belonging to other users or system-critical locations. However, due to the missing authorization logic triggered by the force flag, the application fails to enforce these boundary constraints effectively.
This architectural oversight allows any authenticated user, regardless of their assigned role or permission level regarding peer assets, to execute unauthorized file operations. By supplying a value of one for the force parameter in API requests directed at this endpoint, an attacker can bypass standard access controls and move files from their own designated storage area into directories owned by other users or administrative accounts. This capability fundamentally undermines the multi-tenancy and isolation principles expected within enterprise content management systems where distinct user groups require strict separation of digital assets to maintain data integrity and confidentiality.
The operational impact of this vulnerability extends beyond simple unauthorized file movement. The force parameter typically instructs the system to overwrite existing files in the destination directory without prompting for confirmation or checking for conflicts under normal conditions. When combined with the authorization bypass, an attacker can deliberately replace critical configuration files, templates, or other assets belonging to administrators or other users. This capability facilitates data tampering and potential service disruption by corrupting essential application resources. Furthermore, if the underlying file system permissions allow it, this action could lead to unauthorized deletion of existing files that conflict with the moved asset, resulting in permanent loss of important digital content owned by others within the organization.
From a classification perspective, this vulnerability aligns closely with CWE-269 Improper Privilege Management and CWE-732 Incorrect Permission Assignment for Critical Resource as defined by the Common Weakness Enumeration standards. The failure to verify that the actor has elevated privileges before performing actions affecting resources outside their scope is characteristic of broken access control flaws often exploited in web applications. In terms of tactical mapping, this behavior corresponds to techniques found within the MITRE ATT&CK framework related to Defense Evasion and Impact categories, specifically involving unauthorized modification or deletion of system files to disrupt operations or maintain persistence through compromised content assets.
Mitigation strategies must prioritize immediate software updates as the primary remediation step. Organizations running Craft CMS should upgrade to version 5.10.11 or later where these authorization checks have been properly implemented and validated by the development team. Until an update can be applied, administrators may consider implementing web application firewall rules that restrict access to the assets/move-asset endpoint based on IP reputation or require additional authentication factors for file manipulation operations. Additionally, reviewing server-level permissions to ensure that the web process user does not have excessive write privileges across all asset directories can provide a layer of defense in depth, limiting the potential damage even if an application-layer bypass occurs. Regular auditing of access logs for unusual patterns involving force parameters or cross-user directory movements is also recommended to detect any attempted exploitation activities early.