Craft CMS EUVD-2026-69909

Exploitation requires a valid Craft CMS account with at least the createEntries permission; unauthenticated access is not sufficient. The attacker must also supply or enumerate a valid provisional draft ID belonging to another user - draft IDs may be predictable or observable in multi-user workflows. The vulnerability only affects provisional (unsaved) drafts, not published entries, revisions, or credentials. The flaw is only operationally significant on multi-user Craft CMS 5.x instances where concurrent authoring occurs; single-author installations face no meaningful cross-user risk.

The CVSS 4.0 score of 5.3 (medium) with AV:N/AC:L/AT:N/PR:L/UI:N and uniformly low impact metrics (VC:L/VI:L/VA:L) accurately reflects the limited blast radius: network-reachable, no special attack conditions, but requiring a valid low-privilege account with createEntries permission. The real-world risk is meaningful specifically in multi-author CMS deployments where content editors collaborate concurrently - a malicious or compromised author account could silently erase peers' unsaved work, causing content loss and workflow disruption. In single-author or tightly permissioned instances the risk is negligible. No EPSS data was provided; the absence of KEV listing and no reported POC suggests opportunistic exploitation is not currently observed. No CVSS/description conflicts are present - the network vector and low-privilege requirement are both consistent with a web-based CMS endpoint.

An authenticated Craft CMS user with createEntries permission enumerates or guesses a draft ID belonging to a co-author - for example, by observing URL patterns while reviewing shared content - then sends a crafted POST request to the actionDuplicate() endpoint with the deleteProvisionalDraft parameter set to the victim's draft ID. The missing ownership check allows the server to delete the victim's unsaved work without generating any authorization error. No public POC has been identified, but the mechanism is straightforward for any authenticated user aware of the parameter.