CVE-2026-84797 Overview
Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in the ElementsController::actionDuplicate() method. Authenticated users with the createEntries permission can delete peer provisional drafts by manipulating the deleteProvisionalDraft parameter. The flaw skips ownership checks before removing another user's unsaved draft, exposing in-progress content to unauthorized modification.
The issue is tracked as CWE-862: Missing Authorization and is documented in the GitHub Security Advisory GHSA-2f55-h4xr-92p2.
Critical Impact
Authenticated attackers with entry-creation rights can delete other users' provisional drafts and gain unauthorized access to their in-progress content.
Affected Products
- Craft CMS 5.0.0-rc1 through versions before 5.10.11
- Any Craft CMS deployment permitting multiple content editors with the createEntries permission
- Multi-author editorial environments where provisional drafts are used for in-progress content
Discovery Timeline
- 2026-09-02 - CVE-2026-84797 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84797
Vulnerability Analysis
Craft CMS uses provisional drafts to store unsaved edits made by users while working on entries. Each provisional draft is owned by the user who created it and should only be visible and modifiable by that owner. The ElementsController::actionDuplicate() action accepts a deleteProvisionalDraft parameter that instructs the controller to remove the source provisional draft as part of the duplicate operation.
The controller does not verify that the authenticated user owns the targeted provisional draft before performing the deletion. Any authenticated user holding the createEntries permission can invoke the action against a draft belonging to another user. Deleting the peer draft grants the attacker access to the underlying entry state and effectively hijacks the victim's in-progress work.
Refer to the VulnCheck Advisory for Craft CMS for additional technical context.
Root Cause
The root cause is a missing authorization check [CWE-862] in ElementsController::actionDuplicate(). The action trusts the element identifier supplied in the request without confirming that the current user is the draft's creator. Craft's normal ownership enforcement for provisional drafts is bypassed when the request follows the duplicate-with-delete code path.
Attack Vector
The attack is network-reachable and requires an authenticated session with low privileges. An attacker submits a crafted request to the element duplicate endpoint referencing another user's provisional draft ID and setting deleteProvisionalDraft to true. The controller processes the request without ownership validation, deletes the victim's draft, and exposes the associated content to the attacker.
No verified public exploit code is available. The vulnerability mechanism is described in prose in the vendor advisory linked above.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-84797
Indicators of Compromise
- Unexpected loss of provisional drafts reported by content editors who did not delete their own work.
- HTTP requests to the Craft CMS element duplicate action containing the deleteProvisionalDraft parameter set to true against draft IDs not owned by the requesting user.
- Audit-log entries showing draft deletions performed by users other than the draft owner.
Detection Strategies
- Review web server and application logs for POST requests to the elements/duplicate controller action correlated with user IDs that do not match the target draft's creatorId.
- Enable Craft CMS audit logging or a compatible plugin to track draft creation, duplication, and deletion events by user.
- Alert on spikes in provisional draft deletions, especially from accounts with only the createEntries permission.
Monitoring Recommendations
- Forward Craft CMS application and access logs to a centralized log platform for correlation across editor accounts and draft operations.
- Baseline normal draft duplication behavior per editor and flag deviations, such as one account acting on many peer drafts in a short window.
- Monitor administrative and editor account activity for anomalous authenticated access patterns to CMS endpoints.
How to Mitigate CVE-2026-84797
Immediate Actions Required
- Upgrade Craft CMS to version 5.10.11 or later on all environments running an affected release.
- Audit user accounts holding the createEntries permission and remove the permission from users who do not require entry creation.
- Review recent draft deletion events and coordinate with affected authors to restore lost work from backups.
Patch Information
Craft CMS resolved the issue in version 5.10.11 by adding ownership validation in ElementsController::actionDuplicate() before honoring the deleteProvisionalDraft parameter. See the GitHub Security Advisory GHSA-2f55-h4xr-92p2 for release details and remediation guidance.
Workarounds
- Restrict the createEntries permission to a minimal, trusted set of users until the patch is applied.
- Place the Craft CMS control panel behind additional access controls such as IP allow-listing or VPN-only access.
- Increase backup frequency for content databases so provisional drafts can be recovered if deleted by an unauthorized user.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
