Executive brief
Craft CMS, a popular content management system, contains a security flaw that allows certain authorized users to view private files they should not have access to. Specifically, a user with access to the Control Panel can bypass permission restrictions to generate preview links for private assets. This could lead to the unauthorized disclosure of sensitive documents or media stored within the system.
Technical details
A missing authorization vulnerability exists in the 'assets/preview-thumb' endpoint of Craft CMS. The root cause is a failure to perform 'asset-view' permission checks before generating preview HTML. An authenticated Control Panel user can provide an arbitrary 'assetId' to this endpoint to receive a signed fallback transform preview link for private assets they are not authorized to view. This vulnerability affects versions 4.x starting from 4.0.0-RC1 and 5.x starting from 5.0.0-RC1. The issue is remediated in versions 4.17.8 and 5.9.14 by introducing explicit volume permission checks in the AssetsController.
Affected products
- Craft CMS Craft CMS >= 4.0.0-RC1, <= 4.17.7; >= 5.0.0-RC1, <= 5.9.13
Timeline
- 2026-06-02: advisory: Original advisory GHSA-x76w-8c62-48mg published
- 2026-06-21: advisory: Duplicate advisory GHSA-xj2c-g5xp-4p47 published
- 2026-08-06: other: Duplicate advisory withdrawn