CVE-2026-84798
Received Received - Intake

Authorization Bypass in Craft CMS Leading to Hard-Delete

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: VulnCheck

Description
Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft (which only verifies draft ownership), then propagates the deletion to the canonical element without re-checking permissions. As a result, an authenticated user who has viewEntries, viewPeerEntries, saveEntries, savePeerEntries, and editSite permissions but lacks the deleteEntriesForSite permission can hard-delete a canonical entry's site record (and, for single-site entries, the full element and content), which is irrecoverable via Craft's recycle bin.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84798
EUVD
EUVD-2026-69910

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
craftcms craft_cms From 5.0.0-RC1 (inc) to 5.10.11 (exc)
craftcms craft_cms 5.10.11

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-84798 is an authorization bypass vulnerability in Craft CMS versions 5.0.0-RC1 to 5.10.10. The ElementsController::actionDeleteForSite() method fails to perform an independent authorization check. It verifies a user's ownership of a provisional draft before propagating deletion to the canonical element without re-checking permissions. This allows users with specific permissions but lacking deleteEntriesForSite to hard-delete entries or site records.

Detection Guidance

Check Craft CMS version with: composer show craftcms/cms. If version is >=5.0.0-RC1 and <5.10.11, the system is vulnerable. Review user permissions for viewEntries, viewPeerEntries, saveEntries, savePeerEntries, editSite without deleteEntriesForSite.

Impact Analysis

An authenticated user with viewEntries, viewPeerEntries, saveEntries, savePeerEntries, and editSite permissions but without deleteEntriesForSite can delete canonical entries or site records. This results in irreversible content loss, including hard-deletion of elements, content, structure nodes, and search index for single-site entries. The deletion cannot be recovered via Craft's recycle bin.

Compliance Impact

This vulnerability could lead to unauthorized data deletion, violating GDPR's data integrity and accountability principles or HIPAA's integrity and availability requirements. Unauthorized deletion of records may result in non-compliance, potential fines, and loss of trust. Organizations must ensure proper access controls to maintain regulatory compliance.

Mitigation Strategies

Upgrade Craft CMS to version 5.10.11 or later immediately. Review and restrict user permissions to ensure deleteEntriesForSite is only granted to authorized users. Monitor for unauthorized deletions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84798. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart