Craft CMS versions from 4.0.0‑RC1 up to but excluding 4.17.8, and from 5.0.0‑RC1 up to but excluding 5.9.14 expose a vulnerability that allows any unauthenticated user to request a transform of a private asset. The asset‑generation endpoint does not enforce per‑asset authorization before generating a signed transform URL, which can then be used to retrieve the content. The result is a partial privilege escalation that permits disclosure of confidential images or media. No remote code execution or denial‑of‑service capabilities are present, which aligns with the CVSS score of 2.7.

All installations of Craft CMS between the specified ranges are affected. The vulnerability applies to releases 4.0.0‑RC1 through 4.17.7 and 5.0.0‑RC1 through 5.9.13. The issue has been fixed in version 4.17.8 and in 5.9.14. Vendors and product maintainers listed are CraftCMS (Craft CMS).

The CVSS score of 2.7 indicates moderate severity, primarily due to the lack of authentication for the request. The EPSS score is below 1 % and the vulnerability is not tracked in CISA’s KEV catalog, suggesting that the likelihood of widespread exploitation is low. Nonetheless, the attack can be performed simply by knowing the asset ID and accessing the transform endpoint, allowing the attacker to exfiltrate private asset data. The impact is limited to confidentiality and integrity of the assets, terminating after the transform is performed. Consequently, administrators should treat it as a low‑to‑moderate risk that still warrants prompt mitigations.