CVE-2026-84798

Craft CMS versions 5.0.0-RC1 through 5.10.10 have a missing authorization check (CWE-862) in ElementsController::actionDeleteForSite(): the method loads the element with checkForProvisionalDraft enabled and performs the deletion permission check against the user's own provisional draft, which only verifies draft ownership rather than deletion rights on the live entry. An authenticated backend user who holds viewEntries, viewPeerEntries, saveEntries, savePeerEntries, and editSite permissions but lacks the deleteEntriesForSite permission can trigger the delete-for-site action, and the deletion propagates to the canonical element without a second permission check. The attacker gains the ability to hard-delete a canonical entry's site record and, for single-site entries, the entire element and its content, which is irrecoverable because it bypasses Craft's recycle bin. Any Craft CMS deployment on an affected 5.x version that grants content-editing permissions to non-admin users (common in multi-author editorial teams) is affected; the attacker must already have an authenticated account, so it is not exploitable remotely without credentials. No public proof of concept is known, the flaw is not in CISA's KEV, and EPSS estimates only a 0.2% probability of exploitation in the next 30 days.

What to do: Upgrade to Craft CMS 5.10.11 or later. Until upgraded, audit backend user permission sets for anyone granted view/save (including peer-entry) permissions plus editSite but not deleteEntriesForSite, and consider temporarily revoking editSite from such users. Because this deletion bypasses the recycle bin and is unrecoverable, review recent delete-for-site activity by non-admin users and confirm database backups are current.