Craft CMS (>= 5.0.0-RC1, < 5.10.11) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/craft-cms--5.0.0-rc1--5.10.11/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 02 Sep 2026 13:13:44 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthorization Bypass in Craft CMS assets/move-asset Endpointhttps://feed.craftedsignal.io/briefs/2026-09-craft-cms-auth-bypass/Wed, 02 Sep 2026 13:13:44 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-craft-cms-auth-bypass/Craft CMS versions prior to 5.10.11 contain an authorization bypass in the assets/move-asset endpoint, allowing authenticated users with insufficient permissions to move and delete arbitrary assets by supplying the force=1 parameter.Craft CMS versions before 5.10.11 are vulnerable to an authorization bypass vulnerability (CVE-2026-84794) within the assets/move-asset endpoint. The vulnerability arises when an authenticated user, even without the necessary peer asset permissions, submits a specifically crafted request to move an asset. By supplying the 'force=1' parameter, the attacker can manipulate the move operation to target folders owned by other users. This action can force the deletion of conflicting files already present in the target destination, leading to unauthorized asset replacement and permanent data loss. This flaw highlights a failure in the application's access control logic regarding asset management operations. Organizations utilizing Craft CMS 5.x should upgrade to version 5.10.11 or later to remediate this vulnerability.

Impact

Successful exploitation allows authenticated, low-privileged users to perform unauthorized asset management actions. This results in the potential destruction of data, modification of content, and the ability to replace files within other users' folders, which can disrupt site operations and compromise data integrity.

Recommendation

  • Upgrade all instances of Craft CMS to version 5.10.11 or later immediately.
  • Review web server access logs for anomalous POST requests to the 'assets/move-asset' endpoint.
  • Audit user permissions to ensure that only authorized users possess the necessary privileges for asset management.
  • Deploy the provided web application detection rule to identify attempts to trigger the vulnerable endpoint with the force parameter.
]]>highadvisorycmsweb-vulnerabilityauthorization-bypassweb-applicationvulnerabilityprivilege-escalation