Craft CMS versions from 5.0.0‑RC1 up to but not including 5.10.11 omit an independent authorization check in the ElementsController::actionDeleteForSite() method. The method loads an element with provisional‑draft checks, authorizes against the user’s own provisional draft (only confirming ownership), and then propagates the deletion to the canonical element without any further permission verification. As a result, an authenticated user who possesses viewEntries, viewPeerEntries, saveEntries, savePeerEntries, and editSite permissions but lacks the deleteEntriesForSite permission can permanently delete a canonical entry’s site record, and for single‑site entries the entire element and its content, which cannot be recovered via Craft’s recycle bin.

Craft CMS products built with Craft CMS (craftcms:cms). The vulnerability applies to all versions greater than or equal to 5.0.0‑RC1 and less than 5.10.11.

The CVSS score of 7.1 indicates high severity. The EPSS score is not provided, so current exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Attackers require authentication with specific site‑level viewing and editing permissions but do not need full delete privileges. Once authenticated, the attacker can exploit the flaw to perform irreversible deletion of site content, resulting in significant loss of data and service disruption. The lack of an official workaround means the risk remains until the software is updated.