Is CVE-2026-84794 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-84794?

CVE-2026-84794 has a CVSS v3 severity of HIGH (7.1).

Back

CVE-2026-84794

Description

Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files, allowing unauthorized asset deletion and replacement.