Description

Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate() that allows authenticated users with createEntries permission to delete peer provisional drafts. Attackers can exploit the deleteProvisionalDraft parameter to delete another user's unsaved draft without proper authorization checks, gaining access to the victim's in-progress content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-02T12:17:16.363Z",
  "pubdate": "2026-09-02T12:17:16.363Z",
  "executiveSummary": "Craft CMS versions prior to 5.10.11 contain an authorization bypass vulnerability located within the ElementsController::actionDuplicate() method.\nThe vulnerability allows an authenticated user, who possesses the 'createEntries' permission, to perform unauthorized deletion of provisional drafts created by other users.\nBy manipulating the 'deleteProvisionalDraft' parameter during the duplication request, an attacker can trigger the deletion of peer-authored, unsaved draft content.\nThis flaw represents a significant risk to data integrity and content confidentiality within multi-user CMS environments, as it enables malicious actors to disrupt collaborative workflows or gain unauthorized visibility into sensitive, in-progress content.\nExploitation requires the attacker to have an active account with at least 'createEntries' privileges, making this an authenticated, privilege-escalation-style authorization flaw rather than a remote unauthenticated exploit.\nThe impact includes unauthorized data deletion and potential exposure of sensitive information through the forced removal of content objects.",
  "technicalDetails": "The vulnerability exists within the ElementsController::actionDuplicate() function of the Craft CMS application core. This controller action is intended to handle the duplication of element drafts; however, it fails to implement strict authorization checks on the server-side regarding the ownership of the associated provisional drafts.\nThe root cause is an improper validation of the 'deleteProvisionalDraft' parameter during the execution of the duplication logic. The application logic does not verify if the user attempting to trigger the deletion of a draft has the necessary ownership or administrative permissions to modify or delete that specific draft object.\nThe attack flow proceeds as follows: 1. The attacker, authenticated as a user with 'createEntries' permissions, identifies a target provisional draft ID created by another user. 2. The attacker initiates a request to the ElementsController::actionDuplicate() endpoint. 3. The attacker injects the 'deleteProvisionalDraft' parameter set to the ID of the victim’s unsaved draft. 4. The controller processes the request, erroneously trusting the provided parameter without validating the user's authority to delete the specific draft resource identified by that ID. 5. The application backend proceeds to execute the deletion command, effectively removing the victim's draft from the database.\nBecause the system performs this operation without checking if the requester is the owner of the target draft, an attacker can systematically delete drafts across the installation. This constitutes a broken access control vulnerability (CWE-285/CWE-862).\nAffected versions are strictly limited to Craft CMS releases prior to 5.10.11. The vulnerability is restricted to authenticated users, meaning it cannot be exploited via unauthenticated network access. The impact is limited to the deletion of provisional draft data, but it presents a major operational security risk, as it allows for the destruction of work-in-progress content and unauthorized access to content existence, which may inadvertently reveal sensitive draft titles or metadata prior to their intended publication or deletion by legitimate owners.\nThe lack of server-side authorization enforcement on this specific parameter represents a failure in the application's security architecture for element lifecycle management."
}