PT-2026-54781 · Craft Cms · Craft Cms

Offset · Published 2026-07-01 · Updated 2026-07-02 · CVE-2026-50284

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.17.14 Craft CMS versions 5.0.0-RC1 through 5.9.21

Description An issue exists in the AssetsController::actionDeleteFolder() function where the system only verifies the deleteAssets:<volume-uid> permission for the target folder. It fails to enforce the deletePeerAssets:<volume-uid> permission, despite the Assets::deleteFoldersByIds() function cascading the deletion to all descendant folders and assets regardless of the uploader's privileges. Consequently, a low-privilege user with folder-management rights on a shared volume can delete assets uploaded by other users, bypassing the peer-permission checks implemented in the actionDeleteAsset endpoint.

Recommendations Update to version 4.17.15 Update to version 5.9.22

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-50284

Affected Products

Craft Cms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-50284 · Security Note
• https://github.com/craftcms/cms/commit/b4e08977f0c9bdf002a77f9f6d1346cd55ac0598 · Note
• https://github.com/craftcms/cms/security/advisories/GHSA-7h62-6v23-v8fm · Note
• https://twitter.com/CVEnew/status/2072495343464485230 · Twitter Post
• https://twitter.com/infoflowcloud/status/2072497006514221242 · Twitter Post