Executive brief
Craft CMS, a popular content management system, contains a security flaw that allows logged-in users to view information about files they are not authorized to see. By manipulating file identifiers in the 'preview' feature, a user with limited permissions can bypass access controls to retrieve metadata and preview content for private assets. This could lead to the unauthorized disclosure of sensitive internal documents or images. The issue has been resolved in the latest software updates.
Technical details
An authorization bypass vulnerability exists in Craft CMS within the 'assets/preview-file' endpoint due to a failure to enforce per-asset view permissions. The vulnerable component, AssetsController.php, accepts a user-controlled 'assetId' and returns 'previewHtml' without verifying if the authenticated user has 'viewAssets' or 'viewPeerAssets' permissions for that specific ID. An attacker with low-level authenticated access can exploit this to obtain private preview image routes and metadata. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) and has been patched in versions 4.17.8 and 5.9.14 by adding explicit volume permission checks.
Affected products
- Craft CMS Craft CMS >= 4.0.0-RC1, <= 4.17.7; >= 5.0.0-RC1, <= 5.9.13
Timeline
- 2026-03-24: advisory: Original advisory GHSA-44px-qjjc-xrhq published
- 2026-06-21: disclosed: CVE-2026-56385 published
- 2026-08-06: other: Duplicate advisory GHSA-f4h3-qhg5-j6mq withdrawn