Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-56385

Craft CMS - Authorization Bypass in assets/preview-file Endpoint

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Craft CMS versions >= 5.0.0-RC1, <= 5.9.13 and >= 4.0.0-RC1, <= 4.17.7 contain an authorization bypass in the assets/preview-file endpoint. The action does not enforce per-asset view authorization before returning preview content, allowing an authenticated low-privileged user to supply a controlled assetId for an asset they are not permitted to view and still receive preview response data (previewHtml), including a private preview image route containing the target private assetId. Fixed in 5.9.14 and 4.17.8.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

craftcms cms

Default version status: unaffected

  • 5.0.0-RC1 to < 5.9.14affected
  • 5.9.14unaffected
  • 4.0.0-RC1 to < 4.17.8affected
  • 4.17.8unaffected
pkg:composer/craftcms/cms

References