Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files, allowing unauthorized asset deletion and replacement.

Craft CMS versions prior to 5.10.11 contain a missing authorization check vulnerability in the assets/move-asset endpoint. When the force=1 parameter is supplied, authenticated users who lack peer asset permissions can move their own assets into other users' folders. This flaw enables unauthorized deletion and replacement of conflicting files in target folders. The vulnerability requires an authenticated session but does not require elevated privileges beyond basic login. It allows attackers to manipulate and destroy other users' assets without authorization. The affected endpoint fails to validate whether the requesting user has sufficient permissions over the destination folder or its contents. This represents a broken access control issue classified as high severity. A fix was introduced in Craft CMS version 5.10.11.