CVE-2026-84794
HIGH
NVD
CVSS Score
7.1
Severity
HIGH
Published
Sep 02, 2026
Vendor
unknown
Description
Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files, allowing unauthorized asset deletion and replacement.