# CVE-2026-124431: Craft CMS authorization bypass in volume browser

Source: https://junglewise.ai/threats/cve-2026-124431-craft-cms-from-5-10-0-before-5-11-2-contains-an-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-124431 · Severity: medium · CVSS 4.3 · Published 2026-11-08

Craft CMS is a web content management system used to build and manage websites. A flaw in versions 5.10.0 through 5.11.1 allows authenticated users with limited permissions to view the directory structures of all storage volumes (folders) on the system, even those they should not have access to. While attackers cannot read file contents, this disclosure of directory layouts could aid further attacks or reveal sensitive organizational structure.

Technologies: [Craft CMS](https://junglewise.ai/threats/technologies/craft-cms-1). Vendors: [Craft](https://junglewise.ai/threats/vendors/craft).

## Quick answers

**Is CVE-2026-124431 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-124431 being exploited in the wild.

**How severe is CVE-2026-124431?** Medium severity, with a CVSS score of 4.3, published 8 November 2026.

**Which products and versions are affected?** Craft CMS 5.10.0 to 5.11.1.

**Is there a fix for CVE-2026-124431?** Yes: fixed in 5.11.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-124431 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-124431?** Check whether you run Craft CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.11.2

## Technical details

The vulnerability is a missing authorization check (CWE-862) in the asset replacement modal. When an authenticated user with restricted volume access deletes a linked asset, the replacement volume browser displays all available volumes without verifying permissions. The attack requires user interaction (asset deletion and modal navigation) and affects only the directory structure enumeration, not file access.

## Affected products

- Craft CMS 5.10.0 to 5.11.1

## Timeline

- 2026-10-23: disclosed: GitHub security advisory published
- 2026-11-08: advisory: NVD and CVE tracking

## References

- [https://github.com/craftcms/cms/security/advisories/GHSA-hvp5-pwxx-2752](https://github.com/craftcms/cms/security/advisories/GHSA-hvp5-pwxx-2752)
- [https://www.vulncheck.com/advisories/craft-cms-5.10.0-before-5.11.2-unauthorized-volume-browsing-via-asset-replacement](https://www.vulncheck.com/advisories/craft-cms-5.10.0-before-5.11.2-unauthorized-volume-browsing-via-asset-replacement)

## Related threats

- [Craft CMS SQL injection in craft.search](https://junglewise.ai/threats/cve-2026-115934-an-unauthenticated-sql-injection-can-occur-on-the-front-end-of)
- [Craft CMS privilege escalation in public registration](https://junglewise.ai/threats/cve-2026-124429-craft-cms-from-5-0-0-before-5-11-2-contains-a-privilege)
- [Craft CMS path traversal in app/icon-svg endpoint](https://junglewise.ai/threats/cve-2026-124428-craft-cms-from-5-7-0-before-5-11-2-contains-an-arbitrary-file)
- [Craft CMS authorization bypass in GraphQL schema scope](https://junglewise.ai/threats/cve-2026-124427-craft-cms-from-5-0-0-before-5-11-2-contains-an-authorization)
- [Craft CMS authorization bypass in GraphQL localized field](https://junglewise.ai/threats/cve-2026-124426-craft-cms-from-5-0-0-before-5-11-2-contains-an-authorization)