Executive brief
Craft CMS is a popular content management and digital asset management platform. A vulnerability in the assets management component allows authenticated control panel users to discover metadata (asset count and storage size) about volumes they are not permitted to access, potentially exposing sensitive information about the organization's asset library structure and capacity.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the AssetsController::actionMoveInfo action introduced in version 5.7.0. The endpoint enforces only requireCpRequest() and requirePostRequest() checks but fails to call requireVolumePermissionByFolder('viewAssets', ...) like other asset-reading endpoints do. An authenticated control panel user can submit POST requests to assets/move-info with arbitrary folderIds to retrieve aggregate metadata (asset count and total storage size) for volumes they cannot view. The impact is limited to metadata disclosure with no access to actual file content or filenames. The vulnerability was patched in version 5.10.12.
Affected products
- Craft CMS 5.7.0 to before 5.10.12
Timeline
- 2026-08-18: disclosed: GitHub Security Advisory GHSA-5mjc-jqcw-6vrp published
- 2026-09-02: patched: Fix released in version 5.10.12
- 2026-09-02: other: CVE-2026-84802 assigned