CVE-2026-84798 Overview
CVE-2026-84798 is an authorization bypass vulnerability in Craft CMS versions >= 5.0.0-RC1 and < 5.10.11. The flaw resides in ElementsController::actionDeleteForSite(), which fails to perform an independent permission check before deleting canonical entries. An authenticated user without the deleteEntriesForSite permission can hard-delete a canonical entry's site record. For single-site entries, this destroys the entire element and its content. The deletion bypasses Craft's recycle bin, making the operation irrecoverable. The vulnerability is classified as [CWE-862] Missing Authorization.
Critical Impact
Authenticated low-privilege users can permanently destroy canonical Craft CMS entries without the required delete permission, with no recovery path through the recycle bin.
Affected Products
- Craft CMS versions >= 5.0.0-RC1
- Craft CMS versions < 5.10.11
- Deployments using multi-site or single-site entries with delegated editorial roles
Discovery Timeline
- 2026-09-02 - CVE-2026-84798 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-84798
Vulnerability Analysis
The vulnerability exists in the actionDeleteForSite() method of ElementsController in Craft CMS. The method loads the target element with the checkForProvisionalDraft flag enabled. This causes Craft to substitute the user's own provisional draft for the canonical element during authorization.
The deletion authorization check then evaluates against the provisional draft rather than the canonical entry. Since users own their provisional drafts by definition, the check only verifies draft ownership. The controller subsequently propagates the delete operation to the canonical element without re-evaluating permissions against it.
The result is a broken access control condition. A user holding viewEntries, viewPeerEntries, saveEntries, savePeerEntries, and editSite permissions, but explicitly lacking deleteEntriesForSite, can trigger destruction of canonical content. For single-site entries, the full element and its content are removed. Craft's recycle bin does not capture these deletions, so recovery requires restoring from database backups.
Root Cause
The root cause is a Missing Authorization defect [CWE-862]. The controller conflates authorization over a provisional draft with authorization over the canonical element. It relies on a single, contextually incorrect permission check instead of independently verifying that the acting user holds deleteEntriesForSite on the canonical target.
Attack Vector
The attack requires network access to the Craft CMS control panel and authenticated session with editorial permissions. An attacker with a low-tier editor account crafts a request to the elements/delete-for-site action against a canonical entry they can view or edit. The request succeeds despite the account lacking site-scoped delete rights, causing irreversible removal of the entry's site record or full element.
Refer to the GitHub Security Advisory GHSA-5fh8-74j8-mvcp and the VulnCheck Advisory on Craft CMS for further technical detail.
Detection Methods for CVE-2026-84798
Indicators of Compromise
- Unexpected POST requests to /actions/elements/delete-for-site originating from non-administrative accounts.
- Craft CMS audit log entries showing canonical entries deleted by users without the deleteEntriesForSite permission.
- Missing single-site entries with no corresponding recycle bin record.
- Sudden decreases in entry counts for specific sites correlated with editor-tier account activity.
Detection Strategies
- Enable and review Craft's action logs for calls to ElementsController::actionDeleteForSite() and correlate the acting user's assigned permissions.
- Compare pre- and post-request database state for the elements and elements_sites tables to identify unauthorized removals.
- Deploy web application firewall (WAF) rules that flag delete-for-site requests initiated by session tokens tied to accounts lacking site-delete rights.
Monitoring Recommendations
- Alert on any deletion action against canonical entries performed by non-admin roles.
- Track database write operations touching elements_sites outside of maintenance windows.
- Forward Craft CMS application logs to a centralized log platform for retention and correlation with authentication events.
How to Mitigate CVE-2026-84798
Immediate Actions Required
- Upgrade Craft CMS to version 5.10.11 or later immediately.
- Audit user group permissions and remove editSite from roles that do not require site-record management.
- Verify recent database backups are intact and restorable in case unauthorized deletions have already occurred.
- Review Craft CMS access logs for prior invocations of the delete-for-site action by non-privileged users.
Patch Information
Craft CMS 5.10.11 introduces an independent authorization check inside actionDeleteForSite() that evaluates the deleteEntriesForSite permission against the canonical element before propagating the deletion. Details are available in GitHub Security Advisory GHSA-5fh8-74j8-mvcp.
Workarounds
- Restrict control panel access to trusted administrator accounts until the upgrade is completed.
- Temporarily revoke editSite from editor and author roles to reduce the exploitable population.
- Place the Craft CMS admin path behind an IP allowlist or VPN gateway to limit exposure.
- Maintain frequent, tested database backups so canonical entry deletions can be restored.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
