Craft CMS versions prior to 5.10.11 lack checks on the assets/move-asset endpoint when the force parameter is set to 1. An authenticated user without permission to edit a peer’s assets can move assets into that user’s folders and force the deletion of any conflicting files. This allows the attacker to delete or overwrite another user’s assets, compromising data integrity and potentially exposing sensitive media.

The affected system is Craft CMS, specifically versions 5.0.0 through 5.10.10. All releases before 5.10.11 contain the vulnerability. The issue is limited to the assets/move-asset endpoint.

The CVSS score is 7.1, indicating a high severity risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an authenticated user sending a request to the assets/move-asset endpoint with force=1. No special conditions beyond valid credentials are needed; the lack of authorization checks means any authenticated user can exploit the flaw to delete or replace assets belonging to other users.