CVE-2026-56385

Craft CMS - Authorization Bypass in assets/preview-file Endpoint

Published Jun 21, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

Craft CMS versions >= 5.0.0-RC1, <= 5.9.13 and >= 4.0.0-RC1, <= 4.17.7 contain an authorization bypass in the assets/preview-file endpoint. The action does not enforce per-asset view authorization before returning preview content, allowing an authenticated low-privileged user to supply a controlled assetId for an asset they are not permitted to view and still receive preview response data (previewHtml), including a private preview image route containing the target private assetId. Fixed in 5.9.14 and 4.17.8.

Analysis

Technical impact

Craft CMS contains an authorization bypass in the assets/preview-file endpoint that does not enforce per‑asset view permissions before returning preview data. An authenticated user with low privileges can request a controlled assetId that they are not authorized to view and still receive the previewHtml response, which includes a private preview image route containing the target assetId. This flaw allows a confidentiality breach of private assets that should be restricted to higher‑privileged users.

Affected Systems

The affected product is Craft CMS. Versions 4.0.0‑RC1 through 4.17.7 inclusive, and 5.0.0‑RC1 through 5.9.13 inclusive, are vulnerable.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, but the flaw requires only an authenticated low‑privileged user and can be exploited via the publicly reachable assets/preview-file endpoint. Attackers can exfiltrate sensitive preview content, potentially exposing private assets and routing information.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

craftcms

cms

unaffected

Version	Status	Constraints
`5.0.0-RC1`	affected	< 5.9.14
`5.9.14`	unaffected	—
`4.0.0-RC1`	affected	< 4.17.8
`4.17.8`	unaffected	—

No data.

Vendor Product Versions

Craftcms

Version	Status	Scheme	Platform
`[5.0.0-RC1,5.9.14)`	affected	semver	—
`5.9.14`	unaffected	semver	—
`[4.0.0-RC1,4.17.8)`	affected	semver	—
`4.17.8`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Craft CMS to version 5.9.14 or 4.17.8 and later.
If a patch is not immediately available, restrict access to the /assets/preview-file route or implement endpoint‑level authorization checks to enforce per‑asset view permissions.
Review asset permission configurations to ensure only authorized roles can request previews and audit logs for unauthorized preview attempts.

Generated by OpenCVE AI on June 21, 2026 at 16:36 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-44px-qjjc-xrhq	Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.359% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27
https://github.com/craftcms/cms/security/advisories/GHSA-44px-qjjc-xrhq
https://www.vulncheck.com/advisories/craft-cms-authorization-bypass-in-assets-preview-file-endpoint

History

Jun 24, 2026 4:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Craftcms Craftcms craftcms
Vendors & Products		Craftcms Craftcms craftcms

Jun 22, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 21, 2026 3:00 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Craft CMS versions >= 5.0.0-RC1, <= 5.9.13 and >= 4.0.0-RC1, <= 4.17.7 contain an authorization bypass in the assets/preview-file endpoint. The action does not enforce per-asset view authorization before returning preview content, allowing an authenticated low-privileged user to supply a controlled assetId for an asset they are not permitted to view and still receive preview response data (previewHtml), including a private preview image route containing the target private assetId. Fixed in 5.9.14 and 4.17.8.
Title		Craft CMS - Authorization Bypass in assets/preview-file Endpoint
First Time appeared		Juzaweb Juzaweb cms
Weaknesses		CWE-639
CPEs		cpe:2.3:a:juzaweb:cms::::::::
Vendors & Products		Juzaweb Juzaweb cms
References		https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27 https://github.com/craftcms/cms/security/advisories/GHSA-44px-qjjc-xrhq https://www.vulncheck.com/advisories/craft-cms-authorization-bypass-in-assets-preview-file-endpoint
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}` cvssV4_0 `{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}`