Craft CMS versions 4.0.0-rc1 through 4.17.14 and 5.0.0-rc1 through 5.9.21 contain a missing permission enforcement in the AssetsController::actionDeleteFolder method. The function only checks for deleteAssets permission on the target volume and omits the required deletePeerAssets check, even though the deletion cascade removes all descendant folders and assets regardless of uploader ownership. This missing check allows a user with folder-management rights on a shared volume to delete assets that belong to other users, resulting in loss of content and data integrity. The flaw is classified as CWE-862.

Any Craft CMS instance running any of the affected releases - 4.0.0-rc1 to 4.17.14 or 5.0.0-rc1 to 5.9.21 - with a shared volume that grants low-privilege users folder-management rights is vulnerable. The vulnerability is limited to the assets module and does not require higher privileges beyond the permissions normally granted for folder handling.

The CVSS score of 7.1 indicates high severity. The EPSS score is listed as less than 1%, implying a very low probability of exploitation but not zero, and the vulnerability is not referenced in the CISA KEV catalog, suggesting it is not a known actively exploited issue. The attack vector is most likely an authenticated user with folder-management rights on a shared volume who initiates a delete operation on a folder, thereby bypassing per-asset permission checks and removing peer assets.