CVE-2026-50284

Received Received - Intake

Unauthorized Asset Deletion in Craft CMS

Publication date: 2026-07-01

Last updated on: 2026-07-01

Assigner: GitHub, Inc.

Description

Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.21 and 4.0.0-RC1 through 4.17.14, theAssetsController::actionDeleteFolder() only requires the deleteAssets:<volume-uid> permission for the target folder. It never enforces deletePeerAssets:<volume-uid>, even though Assets::deleteFoldersByIds() cascades deletion to every descendant folder and every asset inside, regardless of the uploader's assigned privileges. A low-privilege user who has been granted folder-management rights on a shared volume can therefore destroy assets uploaded by other users (peer assets), bypassing the per-asset peer-permission check that the sibling actionDeleteAsset endpoint correctly applies. This issue has been fixed in versions 4.17.15 and 5.9.22.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-01

Last Modified

2026-07-01

Generated

2026-07-02

AI Q&A

2026-07-02

EPSS Evaluated

N/A

NVD

CVE-2026-50284

Affected Vendors & Products

Vendor	Product	Version / Range
craftcms	craft_cms	From 4.0.0-RC1 (inc) to 4.17.14 (inc)
craftcms	craft_cms	From 5.0.0-RC1 (inc) to 5.9.21 (inc)
craftcms	craft_cms	4.17.15
craftcms	craft_cms	5.9.22

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Craft CMS versions 5.0.0-RC1 through 5.9.21 and 4.0.0-RC1 through 4.17.14. It occurs because the AssetsController::actionDeleteFolder() method only requires the deleteAssets:<volume-uid> permission to delete a folder, but does not enforce the deletePeerAssets:<volume-uid> permission. As a result, when a folder is deleted, all descendant folders and assets inside are also deleted without checking if the user has permission to delete peer assets uploaded by other users.

This means a low-privilege user who has folder-management rights on a shared volume can delete assets uploaded by other users, bypassing the intended per-asset peer-permission checks that are correctly applied in other parts of the system.

The issue was fixed in versions 4.17.15 and 5.9.22.

Impact Analysis

This vulnerability can allow a low-privilege user with folder-management rights to delete assets uploaded by other users on a shared volume. This can lead to unauthorized destruction of important content, data loss, and disruption of operations that rely on those assets.

Because the deletion cascades to all descendant folders and assets, the impact can be significant, potentially affecting large amounts of data.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Craft CMS to version 4.17.15 or later, or version 5.9.22 or later, where the issue has been fixed.

Hi! I’m here to help you understand CVE-2026-50284. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70