CVE-2026-84794: Craft CMS CMS

High severity, CVSS 7.1. EPSS: 0.4% chance of exploitation in the next 30 days.

Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files, allowing unauthorized asset deletion and replacement.

Affected products

• Craft CMS CMS: from 5.0.0-RC1, before 5.10.11 (fixed in 5.10.11)

Published 2026-09-02. Last modified 2026-09-04.