Craft CMS AssetsController Missing Peer Permission Check Vulnerability Advisory

Vulnerability Overview A missing peer permission check exists in the method of Craft CMS. The method only requires the permission to delete the target folder, without enforcing the permission. This allows low-privileged users to delete assets uploaded by others via cascading delete operations. Affected Versions Affected Versions: - Composer package: >= 5.0.0-RC1, = 4.0.0-RC1, < 4.17.15 Fixed Versions: - Composer package: 5.9.22 and 4.17.15 Remediation Peer permission checks have been added to the method to ensure that both and permissions are verified when deleting a folder and its contents. The specific fix involves adding the following check: The patched code includes an additional call to to ensure peer permissions are checked before deleting the folder. Proof of Concept (POC) The following code snippet illustrates the vulnerability logic prior to the fix: Impact Integrity/Availability: An attacker can permanently delete assets belonging to other users (along with their parent folder structure), and these cannot be recovered via the Craft UI. Permission Model: The Craft permission model explicitly distinguishes between "deleting one's own assets" and "deleting other users' assets." This vulnerability renders the latter protection ineffective. No Code Execution: There is no information disclosure or remote code execution; the impact is limited to the contents of the affected volume. No Special Configuration Required: The affected endpoint is enabled by default, and it only requires the administrator to possess the permission (a documented and supported permission in the model). References GHSA-7h62-6v23-v8tm

Goal Reached Thanks to every supporter — we hit 100%!

Craft CMS AssetsController Missing Peer Permission Check Vulnerability Advisory

More from this source