CVE-2026-84794

7.1 highEPSS 0.4%

High (7.1). EPSS 0.4% chance of exploitation in the next 30 days.

Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files, allowing unauthorized asset deletion and replacement.

Severity

CVSS 4.0

7.1 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

7.1 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-11-01)
CWE: CWE-862
Published: 2026-09-02
Modified: 2026-09-04
Record from: the NVD, synced 2026-10-19

References

https://github.com/craftcms/cms/security/advisories/GHSA-9xvf-7w97-83mv
https://www.vulncheck.com/advisories/craft-cms-5.0.0-through-5.10.10-authorization-bypass-via-assets-move-asset

Check your stack JSON