VULNERABILITY INTELLIGENCE
CVE-2026-84794
CVSS score7.1 HIGH
EPSS probability0.35%
CISA KEVNot currently listed
Published2026-09-02
Last modified2026-09-04
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L
Description
Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files, allowing unauthorized asset deletion and replacement.
Weakness classification
- disclosure@vulncheck.com: CWE-862