CVE-2026-84794

Craft CMS versions before 5.10.11 lack an authorization check (CWE-862, Missing Authorization) on the assets/move-asset endpoint when the request includes force=1, so the server does not verify peer asset permissions before performing the operation. A low-privileged authenticated user can exploit this by moving one of their own assets into another user's folder with force=1, which also deletes any conflicting file already present in the destination folder. The attacker gains unauthorized deletion and replacement of assets stored in other users' folders, producing high integrity and low availability impact with no confidentiality impact. All Craft CMS deployments running a version earlier than 5.10.11 are affected, and exploitation requires a valid low-privileged account rather than unauthenticated access. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS estimates only a ~0.2% probability of exploitation within 30 days.

What to do: Upgrade to Craft CMS 5.10.11 or later, which restores the missing authorization check on the assets/move-asset endpoint. Until patching, restrict which authenticated roles may invoke asset-move operations or write into other users' folders, and audit asset folders for unexpected moves or missing files. Because the flaw requires a valid login, reviewing low-privilege user accounts and their asset permissions is a sensible interim check.