https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 16:55:13 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-84798 <p>Craft CMS versions &gt;= 5.0.0-RC1 and &lt; 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user&#39;s own provisional draft (which only verifies draft ownership), then propagates the deletion to the canonical element without re-checking permissions. As a result, an authenticated user who has viewEntries, viewPeerEntries, saveEntries, savePeerEntries, and editSite permissions but lacks the deleteEntriesForSite permission can hard-delete a canonical entry&#39;s site record (and, for single-site entries, the full element and content), which is irrecoverable via Craft&#39;s recycle bin.</p> <p>Craft CMS versions &gt;= 5.0.0-RC1 and &lt; 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user&#39;s own provisional draft (which only verifies draft ownership), then propagates the deletion to the canonical element without re-checking permissions. As a result, an authenticated user who has viewEntries, viewPeerEntries, saveEntries, savePeerEntries, and editSite permissions but lacks the deleteEntriesForSite permission can hard-delete a canonical entry&#39;s site record (and, for single-site entries, the full element and content), which is irrecoverable via Craft&#39;s recycle bin.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-84798 https://vulnerability.circl.lu/vuln/ghsa-423p-fc4f-r86r <p>Craft CMS versions &gt;= 5.0.0-RC1 and &lt; 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user&#39;s own provisional draft (which only verifies draft ownership), then propagates the deletion to the canonical element without re-checking permissions. As a result, an authenticated user who has viewEntries, viewPeerEntries, saveEntries, savePeerEntries, and editSite permissions but lacks the deleteEntriesForSite permission can hard-delete a canonical entry&#39;s site record (and, for single-site entries, the full element and content), which is irrecoverable via Craft&#39;s recycle bin.</p> <p>Craft CMS versions &gt;= 5.0.0-RC1 and &lt; 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method loads an element with checkForProvisionalDraft enabled and runs the deletion authorization check against the user&#39;s own provisional draft (which only verifies draft ownership), then propagates the deletion to the canonical element without re-checking permissions. As a result, an authenticated user who has viewEntries, viewPeerEntries, saveEntries, savePeerEntries, and editSite permissions but lacks the deleteEntriesForSite permission can hard-delete a canonical entry&#39;s site record (and, for single-site entries, the full element and content), which is irrecoverable via Craft&#39;s recycle bin.</p> https://vulnerability.circl.lu/vuln/ghsa-423p-fc4f-r86r