CVE-2026-84800
Received Received - Intake

Missing Authorization in Craft CMS Allows Asset Overwrite

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: VulnCheck

Description
Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the target asset is resolved by folder and filename after the permission checks execute, so the replacePeerFiles permission is never enforced. An authenticated low-privilege author with only the replaceFiles permission on a shared folder can overwrite the content of a peer's asset file (located in the same folder) with attacker-controlled bytes. Fixed in 5.10.11.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84800
EUVD
EUVD-2026-69912

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
craftcms craft_cms From 5.0.0-rc1 (inc) to 5.10.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-84800 is a missing authorization flaw in Craft CMS versions 5.0.0-RC1 to 5.10.10. It allows an authenticated low-privilege author with replaceFiles permission to overwrite another user's file in the same shared folder by omitting the assetId parameter. The target file is resolved after permission checks, bypassing the replacePeerFiles permission enforcement.

Detection Guidance

Check Craft CMS version with: composer show craftcms/cms. If version is between 5.0.0-RC1 and 5.10.10, the system is vulnerable. Review web server access logs for suspicious POST requests to /actions/assets/replace-file with sourceAssetId and targetFilename but missing assetId.

Impact Analysis

An attacker could replace a file with malicious content, leading to data corruption, defacement, or potential execution of arbitrary code if the file is later used by the system. This could disrupt operations or compromise user data.

Compliance Impact

This vulnerability could lead to unauthorized file modifications, potentially violating data integrity requirements in GDPR and HIPAA. Unauthorized changes to sensitive files may result in non-compliance with these regulations.

Mitigation Strategies

Upgrade Craft CMS to version 5.10.11 or later immediately. Temporarily revoke replaceFiles permission from low-privilege authors until upgrade is complete. Monitor file changes in shared folders for unauthorized modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84800. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart