CVE-2026-84797 in Craft CMS
Summary
by MITRE • 09/02/2026
Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate() that allows authenticated users with createEntries permission to delete peer provisional drafts. Attackers can exploit the deleteProvisionalDraft parameter to delete another user's unsaved draft without proper authorization checks, gaining access to the victim's in-progress content.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
Craft CMS versions prior to 5.10.11 are affected by a critical authorization bypass vulnerability located within the ElementsController::actionDuplicate() method. This flaw stems from an insufficient verification of user permissions when handling draft operations, specifically regarding provisional drafts which represent unsaved content in progress. The core technical deficiency lies in the application's failure to validate that the authenticated user initiating the deletion request is the actual owner or authorized editor of the specific draft being targeted. Instead of enforcing strict ownership checks against the database records associated with each draft entry, the system relies on a broader permission scope that grants access based solely on general site permissions rather than granular resource-level authorization. This architectural oversight allows any authenticated user possessing the createEntries permission to interact with drafts belonging to other users, effectively bypassing intended isolation boundaries between different content creators within the same workspace or project.
The operational impact of this vulnerability is significant for organizations relying on Craft CMS for collaborative content management workflows. An attacker who has obtained valid credentials and holds at least the createEntries privilege can exploit the deleteProvisionalDraft parameter to remove another user's unsaved work without triggering any access control errors. This action results in the permanent loss of uncommitted data, which may include sensitive business information, proprietary drafts, or personally identifiable information contained within those provisional entries. Beyond immediate data destruction, this capability facilitates a denial-of-service condition against specific content creators and can be leveraged as part of a broader attack chain to disrupt editorial processes or cover tracks by eliminating evidence of prior unauthorized access attempts. The ability to manipulate peer drafts undermines the integrity of the version control system inherent in CMS platforms that utilize draft-based workflows for pre-publishing content review.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization, as the application fails to enforce proper access controls on sensitive actions performed by authenticated users. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior corresponds to T1078 Valid Accounts where an attacker uses legitimate credentials to perform unauthorized actions within a system, and potentially T1485 Data Destruction if the intent is malicious deletion rather than mere exploitation for information gathering. The specific mechanism involving the manipulation of draft states via API endpoints or controller actions highlights common pitfalls in web application development where state management logic is decoupled from strict identity verification protocols during write operations.
Mitigation strategies must prioritize immediate patching to version 5.10.11 or later, which resolves this authorization bypass by implementing rigorous ownership validation checks within the ElementsController::actionDuplicate() method. Administrators should ensure that all instances of Craft CMS are updated promptly and verify that no custom plugins or themes have overridden default security behaviors related to draft management. In environments where immediate patching is not feasible due to compatibility constraints, network-level controls such as Web Application Firewalls can be configured to monitor for anomalous patterns in delete requests targeting provisional drafts from non-owning users. Additionally, implementing strict role-based access control policies that limit the createEntries permission only to trusted administrators or senior editors reduces the attack surface by minimizing the number of accounts capable of triggering this vulnerable code path. Regular security audits focusing on authorization logic across all controller actions are recommended to prevent similar privilege escalation flaws in future releases.