Craft CMS from version 5.10.0 up to 5.11.1 contains an authorization bypass that lets authenticated users with limited permissions replace an asset and use the replacement volume browser modal to view directory names in all storage volumes. The flaw does not allow viewing of file contents, but does expose the structure of volumes that are otherwise restricted, giving an attacker a map of inventory that could aid further attacks. This is an information‑disclosure vulnerability classified under CWE‑862 for access control weaknesses.

The affected product is Craft CMS, managed by Craft CMS Systems. The vulnerability applies to all installs of Craft CMS from version 5.10.0 through any release before 5.11.2. Users operating these versions on web sites or content management environments are exposed to the risk.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation. An attacker must be authenticated with a low‑privilege account that retains the ability to replace assets; the exploit path therefore requires knowledge of the CMS configuration and does not permit unauthenticated access. The impact is primarily limited to directory‑level information disclosure and could facilitate subsequent privileged or targeted attacks if the attacker gains additional access later.