CVE-2026-50284: Craft CMS Auth Bypass Vulnerability

CVE-2026-50284 Overview

CVE-2026-50284 is a missing authorization vulnerability [CWE-862] in Craft CMS, an open-source content management system. The flaw resides in the AssetsController::actionDeleteFolder() method, which enforces only the deleteAssets:<volume-uid> permission on the target folder. It fails to verify deletePeerAssets:<volume-uid> before cascading the deletion through Assets::deleteFoldersByIds(). A low-privilege authenticated user with folder-management rights on a shared volume can delete assets uploaded by other users. The vulnerability affects Craft CMS versions 5.0.0-RC1 through 5.9.21 and 4.0.0-RC1 through 4.17.14. Fixed releases are 4.17.15 and 5.9.22.

Critical Impact
Authenticated low-privilege users can destroy peer-owned assets across shared volumes, bypassing per-asset peer-permission enforcement and causing loss of integrity for user-generated content.

Affected Products

Craft CMS versions 5.0.0-RC1 through 5.9.21
Craft CMS versions 4.0.0-RC1 through 4.17.14
Craft CMS installations with shared asset volumes and multi-user folder-management roles

Discovery Timeline

2026-07-01 - CVE-2026-50284 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-50284

Vulnerability Analysis

Craft CMS separates asset permissions into owner scope (deleteAssets) and peer scope (deletePeerAssets). The peer scope governs whether a user can act on assets uploaded by another user within the same volume. The sibling endpoint actionDeleteAsset correctly enforces the peer-permission check on a per-asset basis. The actionDeleteFolder endpoint does not.

When a folder is deleted, Assets::deleteFoldersByIds() recursively removes every descendant folder and every asset inside those folders. The cascade proceeds without evaluating who uploaded each asset. A user granted folder management on a shared volume can therefore erase content owned by higher-privileged users or peer contributors.

Root Cause

The controller called requireVolumePermissionByFolder('deleteAssets', $folder) instead of requireVolumePermissionByFolder('deletePeerAssets', $folder). This single-permission check does not model the peer-ownership boundary that Craft's asset model requires. The result is broken access control at the endpoint boundary while the underlying data-layer method operates without permission awareness.

Attack Vector

An authenticated attacker sends a folder-delete request through the control panel or Assets API against a shared volume where they hold basic folder-management rights. The controller accepts the request and triggers the recursive delete. Assets owned by other users inside the folder tree are removed. No user interaction from victims is required.

php

// Security patch in src/controllers/AssetsController.php
// Source: https://github.com/craftcms/cms/commit/b4e08977f0c9bdf002a77f9f6d1346cd55ac0598

        }

        // Check if it's possible to delete objects in the target volume.
-        $this->requireVolumePermissionByFolder('deleteAssets', $folder);
+        $this->requireVolumePermissionByFolder('deletePeerAssets', $folder);
        $assets->deleteFoldersByIds($folderId);

        return $this->asSuccess();

The patch replaces the owner-scope permission constant with the peer-scope constant, aligning actionDeleteFolder with the enforcement model used by actionDeleteAsset.

Detection Methods for CVE-2026-50284

Indicators of Compromise

Unexpected POST requests to the assets/delete-folder controller action from accounts holding only basic folder-management rights.
Craft CMS audit log entries showing folder deletions followed by loss of assets owned by other users.
Sudden drops in asset counts within shared volumes without corresponding activity from privileged administrators.

Detection Strategies

Correlate web server access logs against Craft CMS user roles to identify folder-delete calls made by users lacking deletePeerAssets permission.
Monitor database delete operations against the assets and volumefolders tables outside normal administrative windows.
Alert on Craft CMS versions running 4.0.0-RC1 through 4.17.14 or 5.0.0-RC1 through 5.9.21 through software inventory scanning.

Monitoring Recommendations

Enable Craft CMS activity logging and forward logs to a central platform for retention and query.
Track HTTP requests targeting /actions/assets/delete-folder and enrich them with authenticated user identity and assigned permissions.
Baseline normal folder-deletion volume per user role and flag statistical outliers.

How to Mitigate CVE-2026-50284

Immediate Actions Required

Upgrade Craft CMS to version 4.17.15 or 5.9.22 as soon as maintenance windows permit.
Audit user role assignments on shared volumes and revoke folder-management rights that are not operationally required.
Review recent folder deletions across shared volumes to confirm no unauthorized removals occurred.

Patch Information

The fix is available in Craft CMS 4.17.15 and 5.9.22. The corrective commit is published in the Craft CMS GitHub repository and documented in the GitHub Security Advisory GHSA-7h62-6v23-v8fm. The patch swaps the permission constant passed to requireVolumePermissionByFolder() so that folder deletion enforces deletePeerAssets.

Workarounds

Restrict deleteAssets permissions on shared volumes to trusted administrators until the upgrade is applied.
Segregate user-uploaded assets into per-user volumes to eliminate peer-permission exposure on shared folders.
Disable the Assets control panel action for low-privilege roles by removing folder management from their permission set.

bash

# Verify installed Craft CMS version and upgrade via Composer
php craft --version
composer require craftcms/cms:^5.9.22 --update-with-dependencies
# Or for the 4.x branch
composer require craftcms/cms:^4.17.15 --update-with-dependencies
php craft up