Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files, allowing unauthorized asset deletion and replacement.

Craft CMS versions prior to 5.10.11 contain a critical authorization bypass vulnerability in the assets/move-asset endpoint. When the force=1 parameter is supplied, the endpoint fails to perform proper authorization checks. Authenticated users who lack peer asset permissions can exploit this flaw to move their own assets into other users' folders. The force parameter additionally triggers deletion of conflicting files, enabling unauthorized asset deletion and replacement. This affects a wide range of Craft CMS 5.x installations up to and including version 5.10.10. The vulnerability requires authentication but does not require elevated privileges beyond a standard user account. It poses risks of data loss, content tampering, and potential disruption to web applications relying on the CMS asset management system. A fix has been issued in version 5.10.11. Advisories have been published by both the Craft CMS GitHub security team and VulnCheck.