Skip to content
Threat Feed
Subscribe

Product

Craft CMS (< 5.10.11)

2 briefs RSS
high advisory

Authorization Bypass in Craft CMS assets/move-asset Endpoint

Craft CMS versions prior to 5.10.11 contain an authorization bypass in the assets/move-asset endpoint, allowing authenticated users with insufficient permissions to move and delete arbitrary assets by supplying the force=1 parameter.

Craft CMS +2 cms web-vulnerability authorization-bypass web-application vulnerability privilege-escalation
1r 3t 1c
critical advisory

Privilege Escalation in Craft CMS via Registration Flaw

Craft CMS versions prior to 5.10.11 contain a vulnerability allowing unauthenticated attackers to inherit administrator privileges by registering with the email address of a deactivated admin account when specific registration settings are active.

Craft CMS cve-2026-84795 privilege-escalation cms
1t 1c