Skip to content
Threat Feed
Subscribe

Product

Craft CMS (< 4.17.15)

1 brief RSS
high advisory

Craft CMS Vulnerability Allows Low-Privilege Users to Delete Peer Assets

A low-privilege user with `deleteAssets` permission in Craft CMS can bypass the `deletePeerAssets` check in the `AssetsController::actionDeleteFolder` function, allowing them to delete assets uploaded by other users (peer assets) within a shared volume, despite lacking the specific `deletePeerAssets` permission, leading to unauthorized data destruction.

Craft CMS +1 craft-cms vulnerability privilege-escalation data-deletion web-application
1t 1c