CVE-2026-84797

Craft CMS versions 5.0.0-RC1 through before 5.10.11 are affected by an authorization bypass in ElementsController::actionDuplicate(). The vulnerability stems from missing authorization checks on the deleteProvisionalDraft parameter, allowing any authenticated user holding the createEntries permis...