Craft CMS includes a GraphQL API mutation that lets an authenticated user with write permission to an asset volume modify or transfer assets that belong to other volumes, including those that are restricted or private. The mutation verifies authorization against the source volume but does not check that the target asset actually resides in the authorized volume, creating a privilege‑escalation flaw.

Craft CMS versions from 4.0.0‑RC1 up to, but not including, 4.17.0‑beta.1 and from 5.0.0 up to, but not including, 5.9.0‑beta.1 are affected. All 4.x and 5.x major releases that include the GraphQL API and asset volume handling fall into this range.

The vulnerability carries a CVSS score of 8.6 (high) and an EPSS score of less than 1%. It is not listed in the CISA KEV catalog. Exploitation requires a valid authenticated account with write access to at least one asset volume; the attacker then sends GraphQL mutations targeting asset IDs in other volumes, bypassing the missing authorization check and enabling unauthorized asset modification or transfer.