Executive brief
Craft CMS is a popular content management system used to build and manage websites. An authenticated user with basic content creation permissions can exploit a flaw in the element duplication feature to delete another user's unsaved drafts and claim ownership of their in-progress work, resulting in loss of that user's edits and unauthorized access to their content.
Technical details
The vulnerability is a missing authorization check (CWE-862) in ElementsController::actionDuplicate(). The method accepts a deleteProvisionalDraft request parameter; after duplicating an element, if the source is a provisional draft and this flag is set, the controller calls deleteElement() directly without a canDelete() authorization check. The duplication itself is only gated by canDuplicateAsDraft(), which for Entry objects checks only createEntries permission (not deletePeerEntryDrafts). An attacker with viewPeerEntryDrafts + createEntries can exploit this to delete another user's provisional draft via a network request. The attacker's copy of the deleted draft is created under their own account, allowing them to gain the victim's in-progress content. Craft CMS 5.10.11 and later patch this issue by adding proper authorization checks.
Affected products
- Craft CMS 5.0.0-RC1 to before 5.10.11
Timeline
- 2026-08-18: disclosed: GitHub Security Advisory GHSA-2f55-h4xr-92p2 published
- 2026-09-02: patched: Patch released in Craft CMS 5.10.11