Craft CMS versions between 4.0.0‑RC1 and 4.17.7 and between 5.0.0‑RC1 and 5.9.13 expose a flaw where the assets/edit‑image endpoint returns image bytes or redirects to a preview without checking whether the authenticated user has permission to view the requested asset. This lack of per‑asset authorization allows a low‑privileged, authenticated user to retrieve private file contents, potentially leaking sensitive data and violating data confidentiality policies. The weakness is an improper authorization issue (CWE‑639).

The affected product is Craft CMS (craftcms:cms). Vulnerable releases include all builds from 4.0.0‑RC1 up to not including 4.17.8, and from 5.0.0‑RC1 up to but not including 5.9.14.

The CVSS score of 4.9 indicates medium severity, and the EPSS score is below 1%, suggesting low current exploit prevalence. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to authenticate to the site with a user that has at least low‑privilege status, then craft an HTTP(S) request to assets/edit‑image with an arbitrary assetId. No additional privileges or network exposure are needed, making the attack relatively straightforward for an authenticated user within the application.