Description

Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft (which only verifies draft ownership), then propagates the deletion to the canonical element without re-checking permissions. As a result, an authenticated user who has viewEntries, viewPeerEntries, saveEntries, savePeerEntries, and editSite permissions but lacks the deleteEntriesForSite permission can hard-delete a canonical entry's site record (and, for single-site entries, the full element and content), which is irrecoverable via Craft's recycle bin.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-02T12:17:16.500Z",
  "pubdate": "2026-09-02T12:17:16.500Z",
  "executiveSummary": "Craft CMS versions 5.0.0-RC1 through 5.10.10 contain a critical authorization vulnerability within the ElementsController::actionDeleteForSite() method. The vulnerability manifests as an authorization bypass, allowing authenticated users with limited permissions to perform unauthorized hard deletions of canonical elements and their site records. This flaw arises from a failure to re-verify permissions after an element is loaded, effectively allowing an attacker to leverage ownership of a provisional draft to trigger a deletion on a canonical record they are otherwise unauthorized to delete. The impact is significant, as it results in irrecoverable data loss, bypassing the recycle bin functionality. Attackers require a baseline level of authenticated access (viewing and saving entries) to exploit this flaw, making it a high-risk concern for multi-user environments where granular permission control is required to prevent destructive actions by lower-privileged users.",
  "technicalDetails": "The vulnerability resides in the ElementsController::actionDeleteForSite() method, which is responsible for handling the deletion of elements associated with specific sites in Craft CMS. The root cause is a logic error in the authorization flow during the deletion process. When an element is requested for deletion with the checkForProvisionalDraft parameter enabled, the application loads the element and subsequently evaluates the user's authorization to perform the action. Critically, the authorization check is performed solely against the context of the user's own provisional draft. This check essentially validates only that the user has ownership rights over that draft rather than verifying the user's permission to delete the underlying canonical element.\nThe attack flow proceeds as follows: First, the attacker must have an authenticated session with sufficient baseline permissions, specifically viewEntries, viewPeerEntries, saveEntries, savePeerEntries, and editSite. While the attacker lacks the deleteEntriesForSite permission, the application logic incorrectly assumes that proving ownership of a provisional draft is sufficient authorization to proceed with the deletion of the associated canonical element. Upon invocation of actionDeleteForSite(), the controller identifies the canonical element linked to the draft and executes the deletion process. Because the system fails to re-validate authorization against the canonical element itself, the controller propagates the deletion command to the database layer. This bypasses the standard access control list (ACL) checks that would normally block the user.\nFor single-site entries, this vulnerability facilitates a complete hard deletion of the element and its corresponding content. Because this process occurs as a hard delete, the data is removed immediately and bypasses the Craft CMS recycle bin, rendering the action permanent and non-recoverable through standard administrative interfaces. This represents a significant failure in the principle of least privilege, as the controller effectively elevates the user's draft-owner status to a site-wide delete operator. The vulnerability affects all versions of Craft CMS from 5.0.0-RC1 up to 5.10.10. The exploitation does not require advanced network-level access, only the ability to authenticate to the CMS and interact with the controller, making it a serious internal security risk for organizations relying on the CMS for collaborative content management."
}