{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-RC1"
            },
            {
              "fixed": "5.9.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0-RC1"
            },
            {
              "fixed": "4.17.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-50284"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-02T18:49:04Z",
    "nvd_published_at": "2026-07-01T23:16:52Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\n`AssetsController::actionDeleteFolder()` only requires the `deleteAssets:\u003cvolume-uid\u003e` permission for the target folder. It never enforces `deletePeerAssets:\u003cvolume-uid\u003e`, even though `Assets::deleteFoldersByIds()` cascades deletion to every descendant folder and every asset inside, regardless of who uploaded them. A low-privilege user who has been granted folder-management rights on a shared volume can therefore destroy assets uploaded by other users (peer assets), bypassing the per-asset peer-permission check that the sibling `actionDeleteAsset` endpoint correctly applies.\n\nThis is the same bug class that was just fixed in `actionMoveFolder` as **GHSA-3w32-23wj-rxg3** (commit `05c2042`, Apr 23 2026); the fix added `requireVolumePermissionByFolder(\u0027deletePeerAssets\u0027, \u2026)` and `savePeerAssets` checks to the move endpoint but did not propagate to the delete-folder endpoint.\n\n## Details\n\n`src/controllers/AssetsController.php:552-569`:\n\n```php\npublic function actionDeleteFolder(): Response\n{\n    $this-\u003erequireAcceptsJson();\n    $folderId = $this-\u003erequest-\u003egetRequiredBodyParam(\u0027folderId\u0027);\n\n    $assets = Craft::$app-\u003egetAssets();\n    $folder = $assets-\u003egetFolderById($folderId);\n\n    if (!$folder) {\n        throw new BadRequestHttpException(\u0027The folder cannot be found\u0027);\n    }\n\n    // Check if it\u0027s possible to delete objects in the target volume.\n    $this-\u003erequireVolumePermissionByFolder(\u0027deleteAssets\u0027, $folder); // \u003c-- only checks deleteAssets\n    $assets-\u003edeleteFoldersByIds($folderId);\n\n    return $this-\u003easSuccess();\n}\n```\n\n`requireVolumePermissionByFolder()` (`src/controllers/AssetsControllerTrait.php:75-88`) only resolves to a single `requirePermission(\u0027deleteAssets:\u003cvol-uid\u003e\u0027)` call. The peer-equivalent helper (`requirePeerVolumePermissionByAsset`) is never invoked because there is no folder-level peer helper that iterates the folder\u0027s contents.\n\n`Assets::deleteFoldersByIds()` (`src/services/Assets.php:311-349`) then enumerates the folder + every descendant folder, queries every asset under those IDs, and calls `Craft::$app-\u003egetElements()-\u003edeleteElement($asset, true)` directly:\n\n```php\n$assetQuery = Asset::find()-\u003efolderId($allFolderIds);\n$elementService = Craft::$app-\u003egetElements();\n\nforeach (Db::each($assetQuery) as $asset) {\n    $asset-\u003ekeepFileOnDelete = !$deleteDir;\n    $elementService-\u003edeleteElement($asset, true);\n}\n```\n\nThis bypasses `Asset::canDelete()` (`src/elements/Asset.php:1515-1536`):\n\n```php\npublic function canDelete(User $user): bool\n{\n    if ($this-\u003eisFolder) { return false; }\n    if (parent::canDelete($user)) { return true; }\n    $volume = $this-\u003egetVolume();\n    if (Assets::isTempUploadFs($volume-\u003egetFs())) { return true; }\n\n    if ($this-\u003euploaderId !== $user-\u003eid) {\n        return $user-\u003ecan(\"deletePeerAssets:$volume-\u003euid\"); // \u003c-- never reached on cascade delete\n    }\n    return $user-\u003ecan(\"deleteAssets:$volume-\u003euid\");\n}\n```\n\nCompare to `actionDeleteAsset` (`src/controllers/AssetsController.php:579-613`), which correctly does:\n\n```php\n$this-\u003erequireVolumePermissionByAsset(\u0027deleteAssets\u0027, $asset);\n$this-\u003erequirePeerVolumePermissionByAsset(\u0027deletePeerAssets\u0027, $asset);\n```\n\nThe fix that landed in `05c2042` for `actionMoveFolder` (`src/controllers/AssetsController.php:733-765`) added both `savePeerAssets` and `deletePeerAssets` `requireVolumePermissionByFolder` checks to mirror the per-asset pattern, but the same hardening was not applied to `actionDeleteFolder` or `actionRenameFolder` (which also calls `deleteFoldersByIds` indirectly through later logic).\n\nThe asymmetry between the two endpoints demonstrates the missing check.\n\n## Impact\n\n- Integrity / availability of other users\u0027 assets on any volume where the attacker has `deleteAssets` but not `deletePeerAssets`: the attacker can permanently delete peer-owned files (and their parent folder structure) on the underlying filesystem, with no recovery via Craft\u0027s UI.\n- The Craft permission model explicitly distinguishes \"delete your own assets\" (`deleteAssets`) from \"delete other users\u0027 assets\" (`deletePeerAssets`) precisely so administrators can grant the former without the latter on shared volumes \u2014 this finding renders that distinction unenforceable for any user given folder-delete rights.\n- No information disclosure or remote code execution; impact is bounded to the affected volume\u0027s contents.\n- Does not require any non-default configuration: the affected endpoint is enabled by default and only requires that an administrator has split `deleteAssets` from `deletePeerAssets` (the documented, supported permission model).",
  "id": "GHSA-7h62-6v23-v8fm",
  "modified": "2026-07-02T18:49:04Z",
  "published": "2026-07-02T18:49:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-7h62-6v23-v8fm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50284"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/commit/b4e08977f0c9bdf002a77f9f6d1346cd55ac0598"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/craftcms/cms"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Craft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users\u0027 assets"
}