CyberRota Analysis
AI-GeneratedCraft CMS versions 5.0.0-RC1 to 5.10.10 are vulnerable due to insufficient authorization checks in the ElementsController::actionDeleteForSite() method, allowing authenticated users with certain permissions to irreversibly delete canonical entries. This flaw can lead to significant data loss, as it bypasses necessary permission checks when propagating deletions from provisional drafts. Organizations using affected versions should prioritize patching to prevent potential exploitation by users with elevated access rights.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user's own provisional draft (which only verifies draft ownership), then propagates the deletion to the canonical element without re-checking permissions. As a result, an authenticated user who has viewEntries, viewPeerEntries, saveEntries, savePeerEntries, and editSite permissions but lacks the deleteEntriesForSite permission can hard-delete a canonical entry's site record (and, for single-site entries, the full element and content), which is irrecoverable via Craft's recycle bin.