Impact

Successful exploitation allows authenticated, low-privileged users to perform unauthorized asset management actions. This results in the potential destruction of data, modification of content, and the ability to replace files within other users' folders, which can disrupt site operations and compromise data integrity.

Recommendation

• Upgrade all instances of Craft CMS to version 5.10.11 or later immediately.
• Review web server access logs for anomalous POST requests to the 'assets/move-asset' endpoint.
• Audit user permissions to ensure that only authorized users possess the necessary privileges for asset management.
• Deploy the provided web application detection rule to identify attempts to trigger the vulnerable endpoint with the force parameter.

This issue is exploitable only under specific configuration scenarios: when public user registration is enabled and email verification is disabled. If these conditions are met, an attacker can register an account using the known email address of a deactivated admin. The application incorrectly maps the new registration to the existing, albeit deactivated, record's administrative privileges, resulting in full unauthorized access. This flaw represents a critical security risk as it bypasses standard access control mechanisms. Defenders must ensure that public registration is limited or strictly monitored and that email verification is enforced to prevent this vector.

Impact

Successful exploitation allows unauthenticated attackers to gain full administrative control over the Craft CMS instance. This can lead to total system compromise, unauthorized data exfiltration, and persistent access to the back-end administrative interface. This vulnerability affects all Craft CMS installations configured with public registration and disabled email verification running versions prior to 5.10.11.

Recommendation

Prioritized actions for security teams:

• Update Craft CMS to version 5.10.11 or later immediately to address CVE-2026-84795.
• Review administrative account configurations to ensure that deactivated accounts are properly purged or restricted.
• Disable public user registration on all production Craft CMS instances unless explicitly required.
• Ensure that email verification is strictly enabled for all user registration flows to mitigate unauthorized account takeovers.