CVE-2026-84794

Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 5.10.11

Description Insufficient authorization checks in the 'assets/move-asset' endpoint occur when the force variable is set to 1. This allows authenticated users who lack peer asset permissions to move their own assets into folders belonging to other users and force the deletion of conflicting files, resulting in unauthorized asset replacement and deletion.

Recommendations Update to version 5.10.11 or later. As a temporary mitigation, restrict the use of the force parameter in the 'assets/move-asset' endpoint.