Description
Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.21 and 4.0.0-RC1 through 4.17.14, theAssetsController::actionDeleteFolder() only requires the deleteAssets:<volume-uid> permission for the target folder. It never enforces deletePeerAssets:<volume-uid>, even though Assets::deleteFoldersByIds() cascades deletion to every descendant folder and every asset inside, regardless of the uploader's assigned privileges. A low-privilege user who has been granted folder-management rights on a shared volume can therefore destroy assets uploaded by other users (peer assets), bypassing the per-asset peer-permission check that the sibling actionDeleteAsset endpoint correctly applies. This issue has been fixed in versions 4.17.15 and 5.9.22.
Published: 2026-07-01
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Craft CMS versions 4.0.0-rc1 through 4.17.14 and 5.0.0-rc1 through 5.9.21 expose a missing peer-permission check in the AssetsController::actionDeleteFolder method. The action only requires the deleteAssets:<volume-uid> permission and fails to enforce deletePeerAssets:<volume-uid> when cascading deletion to descendant folders and assets. This missing check is classified as CWE-862, a missing permission check, allowing a low-privilege user granted folder-management rights on a shared volume to delete assets uploaded by other users, erasing content and compromising data integrity.

Affected Systems

All installations of Craft CMS on the affected releases, namely versions 5.0.0-rc1 through 5.9.21 and 4.0.0-rc1 through 4.17.14, are vulnerable. The issue is confined to the Assets component and does not require elevated privileges beyond those granted for folder management within a shared volume.

Risk and Exploitability

The vulnerability has a CVSS score of 7.1, indicating high severity. The EPSS score of < 1% indicates a very low but non-zero exploitation rate, and it is not listed in the CISA KEV catalog. The likely attack vector is a low-privileged user granted folder-management rights on a shared volume. With those rights, the user can trigger a delete operation on a folder, bypassing per-asset access controls and deleting content belonging to other users.

Generated by OpenCVE AI on July 21, 2026 at 12:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the update to Craft CMS version 4.17.15 or later or 5.9.22 or later to resolve the missing peer-permission check. The patch enforces the deletePeerAssets:<volume-uid> permission, addressing the CWE-862 flaw.
  • Enable or configure audit logs for asset deletion events so that any unauthorized removal of peer assets can be detected and investigated.
  • Review folder-level permissions to ensure deletePeerAssets:<volume-uid> is granted only to trusted roles, preventing low-privilege users from deleting peer assets.

Generated by OpenCVE AI on July 21, 2026 at 12:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-7h62-6v23-v8fm Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets
History

Thu, 02 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
Description Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.21 and 4.0.0-RC1 through 4.17.14, theAssetsController::actionDeleteFolder() only requires the deleteAssets:<volume-uid> permission for the target folder. It never enforces deletePeerAssets:<volume-uid>, even though Assets::deleteFoldersByIds() cascades deletion to every descendant folder and every asset inside, regardless of the uploader's assigned privileges. A low-privilege user who has been granted folder-management rights on a shared volume can therefore destroy assets uploaded by other users (peer assets), bypassing the per-asset peer-permission check that the sibling actionDeleteAsset endpoint correctly applies. This issue has been fixed in versions 4.17.15 and 5.9.22.
Title Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets
Weaknesses CWE-862
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-02T12:46:04.509Z

Reserved: 2026-06-04T16:26:05.985Z

Link: CVE-2026-50284

cve-icon Vulnrichment

Updated: 2026-07-02T12:45:59.931Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T12:45:02Z

Weaknesses