# Craft CMS authorization bypass in assets preview endpoint

Source: https://junglewise.ai/threats/craft-cms-authorization-bypass-in-assets-preview-endpoint-29d83a67  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-21. Updated: 2026-08-06  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 4.3 · Published 2026-06-21

Craft CMS, a popular content management system, contains a security flaw that allows logged-in users to view information about files they are not authorized to see. By manipulating file identifiers in the 'preview' feature, a user with limited permissions can bypass access controls to retrieve metadata and preview content for private assets. This could lead to the unauthorized disclosure of sensitive internal documents or images. The issue has been resolved in the latest software updates.

Technologies: [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 4.3, published 21 June 2026.

**Which products and versions are affected?** craftcms/cms (Packagist) >= 5.0.0-RC1, <= 5.9.13.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a web application.

**Am I affected?** Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authorization bypass vulnerability exists in Craft CMS within the 'assets/preview-file' endpoint due to a failure to enforce per-asset view permissions. The vulnerable component, AssetsController.php, accepts a user-controlled 'assetId' and returns 'previewHtml' without verifying if the authenticated user has 'viewAssets' or 'viewPeerAssets' permissions for that specific ID. An attacker with low-level authenticated access can exploit this to obtain private preview image routes and metadata. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) and has been patched in versions 4.17.8 and 5.9.14 by adding explicit volume permission checks.

## Affected products

- Craft CMS Craft CMS >= 4.0.0-RC1, <= 4.17.7; >= 5.0.0-RC1, <= 5.9.13

## Timeline

- 2026-03-24: advisory: Original advisory GHSA-44px-qjjc-xrhq published
- 2026-06-21: disclosed: CVE-2026-56385 published
- 2026-08-06: other: Duplicate advisory GHSA-f4h3-qhg5-j6mq withdrawn

## References

- [https://github.com/craftcms/cms/security/advisories/GHSA-44px-qjjc-xrhq](https://github.com/craftcms/cms/security/advisories/GHSA-44px-qjjc-xrhq)
- [https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27](https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27)
- [https://www.vulncheck.com/advisories/craft-cms-authorization-bypass-in-assets-preview-file-endpoint](https://www.vulncheck.com/advisories/craft-cms-authorization-bypass-in-assets-preview-file-endpoint)

## Related threats

- [Craft CMS: Stored XSS in the control panel via unescaped draft name](https://junglewise.ai/threats/cve-2026-72787-craft-cms-stored-xss-in-the-control-panel-via-unescaped-draft)
- [Craft CMS: Arbitrary user password reset leading to administrator account takeover](https://junglewise.ai/threats/cve-2026-72786-craft-cms-arbitrary-user-password-reset-leading-to-administrator)
- [Craft CMS authorization bypass in category structure modification](https://junglewise.ai/threats/craft-cms-authorization-bypass-in-category-structure-modification-1555f980)
- [Craft CMS authenticated RCE through Twig sandbox escape](https://junglewise.ai/threats/craft-cms-authenticated-rce-through-twig-sandbox-escape-32ee5ec1)
- [Craft CMS path traversal in ensurePathIsContained](https://junglewise.ai/threats/craft-cms-path-traversal-in-ensurepathiscontained-4adc3058)