# Craft CMS missing authorization in assets preview endpoint

Source: https://junglewise.ai/threats/craft-cms-missing-authorization-in-assets-preview-endpoint-7edb4923  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-21. Updated: 2026-08-06  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 4.3 · Published 2026-06-21

Craft CMS, a popular content management system, contains a security flaw that allows certain authorized users to view private files they should not have access to. Specifically, a user with access to the Control Panel can bypass permission restrictions to generate preview links for private assets. This could lead to the unauthorized disclosure of sensitive documents or media stored within the system.

Technologies: [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 4.3, published 21 June 2026.

**Which products and versions are affected?** craftcms/cms (Packagist) >= 4.0.0-RC1, <= 4.17.7.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a network appliance.

**Am I affected?** Check whether you run craftcms/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization vulnerability exists in the 'assets/preview-thumb' endpoint of Craft CMS. The root cause is a failure to perform 'asset-view' permission checks before generating preview HTML. An authenticated Control Panel user can provide an arbitrary 'assetId' to this endpoint to receive a signed fallback transform preview link for private assets they are not authorized to view. This vulnerability affects versions 4.x starting from 4.0.0-RC1 and 5.x starting from 5.0.0-RC1. The issue is remediated in versions 4.17.8 and 5.9.14 by introducing explicit volume permission checks in the AssetsController.

## Affected products

- Craft CMS Craft CMS >= 4.0.0-RC1, <= 4.17.7; >= 5.0.0-RC1, <= 5.9.13

## Timeline

- 2026-06-02: advisory: Original advisory GHSA-x76w-8c62-48mg published
- 2026-06-21: advisory: Duplicate advisory GHSA-xj2c-g5xp-4p47 published
- 2026-08-06: other: Duplicate advisory withdrawn

## References

- [https://github.com/craftcms/cms/security/advisories/GHSA-x76w-8c62-48mg](https://github.com/craftcms/cms/security/advisories/GHSA-x76w-8c62-48mg)
- [https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27](https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27)
- [https://www.vulncheck.com/advisories/craft-cms-missing-authorization-in-assets-preview-thumb-endpoint](https://www.vulncheck.com/advisories/craft-cms-missing-authorization-in-assets-preview-thumb-endpoint)

## Related threats

- [Craft CMS: Stored XSS in the control panel via unescaped draft name](https://junglewise.ai/threats/cve-2026-72787-craft-cms-stored-xss-in-the-control-panel-via-unescaped-draft)
- [Craft CMS: Arbitrary user password reset leading to administrator account takeover](https://junglewise.ai/threats/cve-2026-72786-craft-cms-arbitrary-user-password-reset-leading-to-administrator)
- [Craft CMS authorization bypass in category structure modification](https://junglewise.ai/threats/craft-cms-authorization-bypass-in-category-structure-modification-1555f980)
- [Craft CMS authenticated RCE through Twig sandbox escape](https://junglewise.ai/threats/craft-cms-authenticated-rce-through-twig-sandbox-escape-32ee5ec1)
- [Craft CMS path traversal in ensurePathIsContained](https://junglewise.ai/threats/craft-cms-path-traversal-in-ensurepathiscontained-4adc3058)