CVE-2026-50283

Full vulnerability record from the local CVENow database.

Description

Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 through 5.9.20, and 4.0.0-RC1 through 4.17.13 contain an authorization issue in the AssetsController::actionReplaceFile that can delete a source asset without source delete permission by supplying both assetId and sourceAssetId. AssetsController::actionReplaceFile() supports replacing a target asset file using another existing asset as the source. The action loads: assetId -> $assetToReplace and sourceAssetId -> $sourceAsset, then enforces replace permissions using ($assetToReplace ?: $sourceAsset). When both IDs are provided, this expression resolves to the target asset so no permission check is performed against the source asset volume. When both assets are present, Craft copies the source file into the target and then deletes the source asset. There is no deletion check for for the source asset. An authenticated user who can replace files in one volume can delete assets in another volume where they do not have delete permission, as long as they can obtain a sourceAssetId, leading to broken content references and data loss. This issue has been fixed in versions 4.17.14 and 5.9.21.

Severity

MEDIUM

CVSS score

5.3 (v4.0)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-07-01 23:16:52.207000

Last modified

2026-10-25 21:10:00.770000

View original CVE JSON

{
  "id": "CVE-2026-50283",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-01T23:16:52.207",
  "lastModified": "2026-10-25T21:10:00.770",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 through 5.9.20, and 4.0.0-RC1 through 4.17.13 contain an authorization issue in the AssetsController::actionReplaceFile that can delete a source asset without source delete permission by supplying both assetId and sourceAssetId. AssetsController::actionReplaceFile() supports replacing a target asset file using another existing asset as the source. The action loads: assetId -> $assetToReplace and sourceAssetId -> $sourceAsset, then enforces replace permissions using ($assetToReplace ?: $sourceAsset). When both IDs are provided, this expression resolves to the target asset so no permission check is performed against the source asset volume. When both assets are present, Craft copies the source file into the target and then deletes the source asset. There is no deletion check for for the source asset. An authenticated user who can replace files in one volume can delete assets in another volume where they do not have delete permission, as long as they can obtain a sourceAssetId, leading to broken content references and data loss. This issue has been fixed in versions 4.17.14 and 5.9.21."
    },
    {
      "lang": "es",
      "value": "Craft CMS es un sistema de gestión de contenido (CMS). Las versiones 5.0.0-RC1 hasta 5.9.20, y 4.0.0-RC1 hasta 4.17.13 contienen un problema de autorización en AssetsController::actionReplaceFile que puede eliminar un activo de origen sin permiso de eliminación de origen al proporcionar tanto assetId como sourceAssetId. AssetsController::actionReplaceFile() admite reemplazar un archivo de activo de destino utilizando otro activo existente como origen. La acción carga: assetId   ->   $assetToReplace y sourceAssetId   ->   $sourceAsset, luego aplica los permisos de reemplazo utilizando ($assetToReplace ?: $sourceAsset). Cuando se proporcionan ambos ID, esta expresión se resuelve en el activo de destino, por lo que no se realiza ninguna verificación de permiso contra el volumen del activo de origen. Cuando ambos activos están presentes, Craft copia el archivo de origen en el destino y luego elimina el activo de origen. No hay verificación de eliminación para el activo de origen. Un usuario autenticado que puede reemplazar archivos en un volumen puede eliminar activos en otro volumen donde no tiene permiso de eliminación, siempre que pueda obtener un sourceAssetId, lo que lleva a referencias de contenido rotas y pérdida de datos. Este problema ha sido solucionado en las versiones 4.17.14 y 5.9.21."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "craftcms",
          "product": "cms",
          "versions": [
            {
              "version": ">= 5.0.0-RC1, < 5.9.21",
              "status": "affected"
            },
            {
              "version": ">= 4.0.0-RC1, < 4.17.14",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-02T14:46:55.781150Z",
          "id": "CVE-2026-50283",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/craftcms/cms/commit/2c2579c7f1030872423f268d0c8b48377101961d",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-qh45-9g5p-m2v4",
      "source": "[email protected]"
    }
  ]
}