2 matches found
CVE-2026-84798
Craft CMS versions = 5.0.0-RC1 and 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite. The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft which only...
7.1CVSS5.5AI score0.00352EPSS
SaveExploits0References4
CVE-2026-84798: Missing Authorization
Craft CMS versions = 5.0.0-RC1 and 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite. The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft which only...
7.1CVSS5.6AI score0.00352EPSS
SaveExploits0References2
20