Security Advisory
CVE-2026-84794
7.1
HIGH
Vulnerability Description
Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files, allowing unauthorized asset deletion and replacement.
Published Date
September 2, 2026
Official Source
NIST NVD Advisory