CVE-2026-84797

Name of the Vulnerable Software and Affected Versions Craft CMS versions prior to 5.10.11

Description An authorization bypass exists in the ElementsController::actionDuplicate() function. Authenticated users with createEntries permission can delete provisional drafts belonging to other users. This is achieved by exploiting the deleteProvisionalDraft parameter, which lacks proper authorization checks, allowing unauthorized access to and deletion of in-progress content.

Recommendations Update Craft CMS to version 5.10.11 or later. As a temporary mitigation, restrict the createEntries permission to trusted users only.