CVE-2026-50282

We have identified an authorization issue in Craft CMS where a forced folder move can delete a conflicting destination folder without destination delete permission.

Description

Craft CMS’s craft\\controllers\\AssetsController::actionMoveFolder() supports moving an asset folder into a destination parent folder. If a folder with the same name already exists at the destination, the action can be called with force=true to overwrite the destination.

The permission checks for this action allow:

• deleteAssets:<sourceVolumeUid> for the folder being moved
• createFolders:<destVolumeUid> for the destination parent folder
• saveAssets:<destVolumeUid> for the destination parent folder

The action does not require deleteAssets on the destination volume or destination conflict folder. When force=true and a name conflict exists, the code deletes the destination folder to resolve the conflict.

$this->requireVolumePermissionByFolder('deleteAssets', $folderToMove);
$this->requireVolumePermissionByFolder('createFolders', $destinationFolder);
$this->requireVolumePermissionByFolder('saveAssets', $destinationFolder);

src/controllers/AssetsController.php:L751-L753

Indexed destination conflicts are deleted via the Assets service:

$assets->deleteFoldersByIds($existingFolder->id);

src/controllers/AssetsController.php:L798-L798

Unindexed destination conflicts are deleted directly in the volume filesystem:

$targetVolume->deleteDirectory(rtrim($destinationFolder->path, '/') . '/' . $folderToMove->name);

src/controllers/AssetsController.php:L815

A user who cannot delete assets in a destination volume can still delete a destination folder and its contents by triggering a forced move into a conflicting name. This can cause asset loss, broken references in entries and fields that point to deleted assets, and operational disruption.

The application does not perform an authorization check before performing a sensitive operation. Typical impact: unauthorized access to restricted functionality or data.

Kodem intelligence

1. What is CVE-2026-50282? CVE-2026-50282 is a high-severity missing authorization vulnerability in craftcms/cms (composer), affecting versions >= 5.0.0-RC1, < 5.9.21. It is fixed in 5.9.21, 4.17.14. The application does not perform an authorization check before performing a sensitive operation.
2. Which versions of craftcms/cms are affected by CVE-2026-50282? craftcms/cms (composer) versions >= 5.0.0-RC1, < 5.9.21 is affected.
3. Is there a fix for CVE-2026-50282? Yes. CVE-2026-50282 is fixed in 5.9.21, 4.17.14. Upgrade to this version or later.
4. Is CVE-2026-50282 exploitable, and should I be worried? Whether CVE-2026-50282 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-50282 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-50282?
   • Upgrade craftcms/cms to 5.9.21 or later
   • Upgrade craftcms/cms to 4.17.14 or later