Craft CMS missing authorization in assets/preview-thumb endpoint

Executive brief

Craft CMS is a content management system used to build and manage websites. A security flaw allowed users with limited access to the administrative Control Panel to view private files they were not authorized to see. By accessing a specific preview endpoint, these users could obtain direct links to private assets, potentially exposing sensitive company data or internal documents.

Technical details

A missing authorization vulnerability exists in Craft CMS within the 'assets/preview-thumb' endpoint. The root cause is a failure to perform explicit asset-view permission checks before generating preview HTML. An authenticated attacker with Control Panel access can provide a specific 'assetId' to this endpoint to receive a signed fallback transform link for private assets. This allows the attacker to bypass intended access controls and view private assets. The issue is fixed in versions 4.17.8 and 5.9.14.

Affected products

• Pixel & Tonic Craft CMS >= 4.0.0-RC1, <= 4.17.7; >= 5.0.0-RC1, <= 5.9.13

Timeline

• 2026-06-02: disclosed: Initial report to vendor
• 2026-07-06: advisory: GitHub Advisory published
• 2026-07-06: patched: Fixes released in 4.17.8 and 5.9.14

References

• https://api.github.com/users/Susen2
• https://github.com/Susen2
• https://api.github.com/users/Susen2/gists%7B/gist_id%7D
• https://api.github.com/users/Susen2/repos
• https://avatars.githubusercontent.com/u/187289153?v=4
• https://api.github.com/users/Susen2/events%7B/privacy%7D