Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method loads …

A critical authorization bypass vulnerability exists in Craft CMS versions >= 5.0.0-RC1 and < 5.10.11. The flaw resides in ElementsController::actionDeleteForSite(), which incorrectly checks deletion permissions against a user's provisional draft rather than the canonical element. This allows authenticated users with certain permissions (viewEntries, viewPeerEntries, saveEntries, savePeerEntries, editSite) but without the deleteEntriesForSite permission to hard-delete canonical entry site records. For single-site entries, this results in complete and irrecoverable deletion of the element and its content, bypassing Craft's recycle bin. The vulnerability stems from missing re-authorization after the provisional draft check propagates the deletion to the canonical element. Users should upgrade to Craft CMS 5.10.11 or later to remediate this issue.