Craft CMS multiple authorization bypasses enable cross-site entry access, asset overwrite/deletion and admin password reset - Upwind | Cloud & AI Security for the Realtime Era

Security Feed

See the latest insights and analysis from our MDR team.

CVE-2026-84794, CVE-2026-84796, CVE-2026-84798, CVE-2026-84800, CVE-2026-84801

By Nevo Evenhaim |

2 September 2026

Craft CMS multiple authorization bypasses enable cross-site entry access, asset overwrite/deletion and admin password reset

Affects craftcms/cms >=5.0.0-RC1 and `