Craft CMS CVE-2026-50284

Exploitation requires an authenticated Craft CMS account (PR:L) that has been granted the deleteAssets:<volume-uid> / folder-management permission on a volume that is SHARED with other users, and that volume must actually contain peer assets (files uploaded by other users). Limiting factors: it is not remote-unauthenticated - an account plus a specific per-volume permission grant is needed; it only affects volumes used by multiple users where the attacker lacks deletePeerAssets but was given folder-delete rights; single-user volumes or deployments that grant deletePeerAssets alongside deleteAssets are not meaningfully exposed; no victim user interaction is required.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N, base 7.1) is internally consistent with the description: network-reachable, low-complexity, requiring low privileges (PR:L - an authenticated user with folder-management rights) and no user interaction, with high integrity impact from destructive deletion and no confidentiality impact. No EPSS score was provided, it is not in CISA KEV, and no POC is referenced, so real-world exploitation pressure appears low despite the moderate-high CVSS. This is a genuine but bounded risk: it only matters where multiple users share a volume and low-privilege accounts have been granted deleteAssets/folder-management without deletePeerAssets - a specific collaborative/multi-tenant configuration rather than a universal default. Note that although CVSS scores availability as VA:N, the practical effect is data destruction, which many organizations would treat as an availability/integrity loss of the deleted content; prioritize accordingly if the volume holds important shared media.

A contributor with folder-management rights on a shared media volume issues a delete-folder request against a parent folder that also contains images uploaded by other editors. Because actionDeleteFolder never checks deletePeerAssets, the cascading deletion removes every peer asset and subfolder in that tree, destroying colleagues' content the attacker was never authorized to touch. No public exploit code is required - the action is triggered through the normal authenticated control-panel/API delete-folder request.