Which versions of Craft CMS are affected by CVE-2026-50284?

Craft CMS versions prior to 4.17.15 and 5.9.22 contain an authorization vulnerability enabling low-privilege authenticated users to permanently delete assets and data uploaded by other users on…. A patch is available.

How to fix or mitigate CVE-2026-50284?

Within 24 hours: Inventory all Craft CMS instances and document current versions (4.x vs 5.x). Within 7 days: Plan and schedule upgrades to Craft CMS 4.17.15 (for v4.x) or 5.9.22 (for v5.x), ensuring change control and backups. Within 30 days: Complete upgrades of all affected instances, prioritizing production environments.

Craft CMS CVE-2026-50284

Q: What is the CVSS score of CVE-2026-50284?

CVE-2026-50284 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-41208 HIGH

Missing Authorization (CWE-862)

2026-07-01 GitHub_M

GHSA-7h62-6v23-v8fm

Authentication Bypass Cms Craftcms

7.1

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Authenticated user with a specific volume permission (PR:L) sends a network request (AV:N/AC:L/UI:N); impact is destructive deletion of peer data, giving I:H with no confidentiality and no distinct availability-service impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 02, 2026 - 20:17 EUVD

Analysis Generated

Jul 01, 2026 - 23:21 vuln.today

DescriptionCVE.org

Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.21 and 4.0.0-RC1 through 4.17.14, theAssetsController::actionDeleteFolder() only requires the deleteAssets:<volume-uid> permission for the target folder. It never enforces deletePeerAssets:<volume-uid>, even though Assets::deleteFoldersByIds() cascades deletion to every descendant folder and every asset inside, regardless of the uploader's assigned privileges. A low-privilege user who has been granted folder-management rights on a shared volume can therefore destroy assets uploaded by other users (peer assets), bypassing the per-asset peer-permission check that the sibling actionDeleteAsset endpoint correctly applies. This issue has been fixed in versions 4.17.15 and 5.9.22.

AnalysisAI

Broken authorization in Craft CMS lets a low-privilege authenticated user destroy other users' assets on a shared volume. AssetsController::actionDeleteFolder() checks only the deleteAssets:<volume-uid> permission for the target folder but never enforces deletePeerAssets:<volume-uid>, while the underlying Assets::deleteFoldersByIds() cascades deletion to every descendant folder and asset regardless of who uploaded them. No public exploit is identified at time of analysis and it is not listed in CISA KEV; the vendor patched it in 4.17.15 and 5.9.22.

Technical ContextAI

Craft CMS is a widely used PHP-based content management system built on the Yii framework. Its asset system enforces two permission tiers per volume: deleteAssets:<volume-uid> covering a user's own uploads and deletePeerAssets:<volume-uid> covering assets uploaded by other users (peer assets). The sibling endpoint actionDeleteAsset correctly applies the peer check, but actionDeleteFolder omits it, and because Assets::deleteFoldersByIds() recursively cascades deletion to all descendant folders and contained assets, the missing check exposes peer-owned data. The root cause is CWE-862 (Missing Authorization): a privileged, cascading operation is performed without validating the peer-authorization that a related non-cascading path requires. The single affected product per CPE is cpe:2.3:a:craftcms:cms.

RemediationAI

Upgrade to the patched releases: Craft CMS 4.17.15 for the 4.x line or 5.9.22 for the 5.x line, per vendor advisory GHSA-7h62-6v23-v8fm (https://github.com/craftcms/cms/security/advisories/GHSA-7h62-6v23-v8fm); the fix is implemented in commit b4e08977f0c9bdf002a77f9f6d1346cd55ac0598. If immediate patching is not possible, the most effective compensating control is to review and tighten volume permissions so low-privilege users on shared volumes are not granted folder-management/deleteAssets rights unless also trusted with deletePeerAssets - the trade-off is those users lose folder-management ability. Alternatively, isolate untrusted or low-privilege uploaders onto their own dedicated volumes so no peer assets exist to cascade-delete, at the cost of losing shared collaboration on a single volume. Maintain and verify off-site backups of asset volumes so any wrongful deletion is recoverable.