CVE-2026-50282 Details
Description
Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 and above, prior to 5.9.21 and versions 4.0.0-RC1 and above prior to 4.17.14 contain an authorization issue where a forced folder move can delete a conflicting destination folder without destination delete permission. Function craft\\controllers\\AssetsController::actionMoveFolder() supports moving an asset folder into a destination parent folder. If a folder with the same name already exists at the destination, the action can be called with force=true to overwrite the destination. This issue has been resolved in versions 5.9.21 and 4.17.14.
An authorization vulnerability has been identified in Craft CMS versions 5.0.0-RC1 and above prior to 5.9.21, as well as in versions 4.0.0-RC1 and above prior to 4.17.14. The issue arises in the AssetsController's actionMoveFolder method, where a forced folder move can inadvertently delete a conflicting destination folder without the necessary delete permissions. This occurs because the permission checks do not require deleteAssets rights on the destination volume or the conflicting folder. As a result, a user lacking the permission to delete assets in a destination volume can still remove a destination folder and its contents by initiating a forced move that creates a name conflict. This vulnerability can lead to unintended asset loss, disrupt references in entries and fields linked to the deleted assets, and cause operational challenges.
Users can update to Craft CMS versions 5.9.21 or 4.17.14 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 2, 2026CISA-ADP
Assessed Jul 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/craftcms/cms/security/advisories/GHSA-3w32-23wj-rxg3 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Craft CMS | >= 5.0.0-RC1, < 5.9.21 (semver) >= 4.0.0-RC1, <= 4.17.14 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 2, 2026 | CVE Modified | CISA-ADP |
| Jul 2, 2026 | New CVE Received | [email protected] |