Authorization Bypass in Craft CMS via ElementsController

Executive Summary

CVE-2026-84797 is an authorization bypass vulnerability in Craft CMS versions before 5.10.11. It affects the ElementsController::actionDuplicate() method, where the deleteProvisionalDraft parameter allows authenticated users with createEntries permission to delete another user's unsaved provisional drafts without proper authorization checks.

Useful 0 Not Useful 0

Detection Guidance

Check Craft CMS version with: composer show craftcms/cms. If version is between 5.0.0-RC1 and 5.10.10, the system is vulnerable. Review user permissions for createEntries and viewPeerEntryDrafts without deletePeerEntryDrafts.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to delete another user's unsaved drafts, causing them to lose in-progress work. The attacker may also gain access to the victim's content through a duplicated draft, potentially leading to unauthorized data exposure or manipulation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or deletion, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using affected Craft CMS versions may face compliance risks.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Craft CMS to version 5.10.11 or later immediately. Remove createEntries permission from users without deletePeerEntryDrafts. Monitor for unauthorized draft deletions or content access.

Useful 0 Not Useful 0