high7.1
CVE-2026-84794
Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied.
Impact
Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files, allowing unauthorized asset deletion and replacement.
Affected products
| Product | Affected versions |
|---|---|
| Craft CMS | before 5.10.11 |
Versions were read from the advisory text. No structured product data has been published for this record yet.