CVE-2026-84794: Craft CMS Auth Bypass Vulnerability

CVE-2026-84794 Overview

Craft CMS versions before 5.10.11 contain a missing authorization check [CWE-862] in the assets/move-asset endpoint. When authenticated users submit requests with the force=1 parameter, the application skips permission validation for peer asset operations. Users without peer asset permissions can move their own assets into folders belonging to other users. The force=1 flag also causes conflicting files in the destination folder to be deleted. Attackers can leverage this behavior to overwrite or delete arbitrary assets belonging to other users. The flaw affects Craft CMS 5.0.0 through 5.10.10.

Critical Impact

Authenticated attackers can delete and replace other users' assets, breaking asset integrity across the Craft CMS installation.

Affected Products

• Craft CMS 5.0.0 through 5.10.10
• Fixed in Craft CMS 5.10.11
• Web applications relying on Craft CMS asset permission model

Discovery Timeline

• 2026-09-02 - CVE-2026-84794 published to NVD
• 2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84794

Vulnerability Analysis

The vulnerability is an authorization bypass in the Craft CMS assets controller. The assets/move-asset endpoint accepts a force=1 parameter intended to resolve filename conflicts when moving assets between folders. When this flag is set, the code path skips the peer asset permission checks that normally prevent one user from acting on another user's files. Any authenticated user with basic asset access can therefore relocate their own assets into folders owned by other users. Because force=1 also triggers deletion of conflicting files at the destination, an attacker can craft a source asset with a target filename to force-delete the victim's file.

Root Cause

The controller logic conditions authorization on the absence of a conflict resolution flag rather than on the identity of the destination folder's owner. This is a classic missing authorization pattern [CWE-862] where a state-changing action bypasses access control when a specific request parameter is supplied.

Attack Vector

Exploitation requires an authenticated Craft CMS account with permission to manage the attacker's own assets. The attacker issues an authenticated HTTP request to the assets/move-asset endpoint specifying a destination folder owned by another user and setting force=1. No user interaction is required from the victim. See the GitHub Security Advisory GHSA-9xvf-7w97-83mv and the VulnCheck Craft CMS Authorization Bypass Advisory for technical details.

Detection Methods for CVE-2026-84794

Indicators of Compromise

• Unexpected deletion or replacement of assets in user-owned folders without corresponding admin activity.
• Web server access log entries containing assets/move-asset requests with the force=1 parameter from non-privileged accounts.
• Craft CMS audit log entries showing cross-user folder moves initiated by low-privilege users.

Detection Strategies

• Review Craft CMS request logs for POST requests to the assets/move-asset action that include force=1.
• Correlate asset deletion events with the requesting user's permission set to flag operations against peer-owned folders.
• Baseline normal asset move activity per user role and alert on deviations that cross ownership boundaries.

Monitoring Recommendations

• Enable verbose logging on the Craft CMS assets controller and forward events to a central SIEM.
• Monitor filesystem changes in Craft CMS asset volumes for unexpected overwrites or removals.
• Alert on any authenticated user submitting force=1 to assets/move-asset unless the user holds peer asset permissions.

How to Mitigate CVE-2026-84794

Immediate Actions Required

• Upgrade Craft CMS to version 5.10.11 or later without delay.
• Audit recent assets/move-asset activity for evidence of unauthorized asset movement or deletion.
• Restore any assets that appear to have been overwritten by unauthorized users from backups.

Patch Information

Craft CMS 5.10.11 introduces the authorization check for the assets/move-asset endpoint when force=1 is supplied. Administrators should apply the upstream fix by upgrading through Composer or the standard Craft CMS update path. Refer to the GitHub Security Advisory GHSA-9xvf-7w97-83mv for the official remediation notes.

Workarounds

• Restrict authenticated account creation and tighten user group permissions until the patch is applied.
• Use a web application firewall rule to block or log requests to assets/move-asset containing force=1 from non-administrative sessions.
• Temporarily disable peer asset folder sharing where feasible to reduce the exposure window.

# Example WAF-style rule to log or block force=1 asset moves pending patch deployment
# ModSecurity pseudo-rule
SecRule REQUEST_URI "@contains /actions/assets/move-asset" \
    "chain,phase:2,deny,status:403,msg:'CVE-2026-84794 mitigation: force asset move blocked'"
    SecRule ARGS:force "@streq 1"