CVE-2026-50284

Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.21 and 4.0.0-RC1 through 4.17.14, theAssetsController::actionDeleteFolder() only requires the deleteAssets:<volume-uid> permission for the target folder. It never enforces deletePeerAssets:<volume-uid>, even though Assets::deleteFoldersByIds() cascades deletion to every descendant folder and every asset inside, regardless of the uploader's assigned privileges. A low-privilege user who has been granted folder-management rights on a shared volume can therefore destroy assets uploaded by other users (peer assets), bypassing the per-asset peer-permission check that the sibling actionDeleteAsset endpoint correctly applies. This issue has been fixed in versions 4.17.15 and 5.9.22.

CVSS

No CVSS.

References

Link	Resource
https://github.com/craftcms/cms/commit/b4e08977f0c9bdf002a77f9f6d1346cd55ac0598
https://github.com/craftcms/cms/security/advisories/GHSA-7h62-6v23-v8fm

Configurations

No configuration.

History

25 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Craft CMS es un sistema de gestión de contenido (CMS). En las versiones 5.0.0-RC1 hasta 5.9.21 y 4.0.0-RC1 hasta 4.17.14, el AssetsController::actionDeleteFolder() solo requiere el permiso deleteAssets:[volume-uid] para la carpeta de destino. Nunca aplica deletePeerAssets:[volume-uid], a pesar de que Assets::deleteFoldersByIds() propaga la eliminación a cada carpeta descendiente y a cada activo dentro, independientemente de los privilegios asignados al usuario que lo subió. Un usuario con pocos privilegios a quien se le han concedido derechos de gestión de carpetas en un volumen compartido puede, por lo tanto, destruir activos subidos por otros usuarios (activos de otros usuarios), eludiendo la verificación de permisos de otros usuarios por activo que el punto final hermano actionDeleteAsset aplica correctamente. Este problema ha sido solucionado en las versiones 4.17.15 y 5.9.22.

Information

Published : 2026-07-01 23:16

Updated : 2026-10-25 21:10

NVD link : CVE-2026-50284

Mitre link : CVE-2026-50284

CVE.ORG link : CVE-2026-50284

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-50284", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50284", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-02T12:45:55.719494Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "craftcms", "product": "cms", "versions": [{"status": "affected", "version": "=>= 5.0.0-RC1, < 5.9.22"}, {"status": "affected", "version": ">= 4.0.0-RC1, < 4.17.15"}]}]}], "published": "2026-07-01T23:16:52.350", "references": [{"url": "https://github.com/craftcms/cms/commit/b4e08977f0c9bdf002a77f9f6d1346cd55ac0598", "source": "security-advisories@github.com"}, {"url": "https://github.com/craftcms/cms/security/advisories/GHSA-7h62-6v23-v8fm", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.21 and 4.0.0-RC1 through 4.17.14, theAssetsController::actionDeleteFolder() only requires the deleteAssets:<volume-uid> permission for the target folder. It never enforces deletePeerAssets:<volume-uid>, even though Assets::deleteFoldersByIds() cascades deletion to every descendant folder and every asset inside, regardless of the uploader's assigned privileges. A low-privilege user who has been granted folder-management rights on a shared volume can therefore destroy assets uploaded by other users (peer assets), bypassing the per-asset peer-permission check that the sibling actionDeleteAsset endpoint correctly applies. This issue has been fixed in versions 4.17.15 and 5.9.22."}, {"lang": "es", "value": "Craft CMS es un sistema de gesti\u00f3n de contenido (CMS). En las versiones 5.0.0-RC1 hasta 5.9.21 y 4.0.0-RC1 hasta 4.17.14, el AssetsController::actionDeleteFolder() solo requiere el permiso deleteAssets:[volume-uid] para la carpeta de destino. Nunca aplica deletePeerAssets:[volume-uid], a pesar de que Assets::deleteFoldersByIds() propaga la eliminaci\u00f3n a cada carpeta descendiente y a cada activo dentro, independientemente de los privilegios asignados al usuario que lo subi\u00f3. Un usuario con pocos privilegios a quien se le han concedido derechos de gesti\u00f3n de carpetas en un volumen compartido puede, por lo tanto, destruir activos subidos por otros usuarios (activos de otros usuarios), eludiendo la verificaci\u00f3n de permisos de otros usuarios por activo que el punto final hermano actionDeleteAsset aplica correctamente. Este problema ha sido solucionado en las versiones 4.17.15 y 5.9.22."}], "lastModified": "2026-10-25T21:10:00.770", "sourceIdentifier": "security-advisories@github.com"}