Missing Authorization Vulnerability in Craft CMS

CVE-2026-56384

What is CVE-2026-56384?

Craft CMS contains a vulnerability in the assets/preview-thumb endpoint, where a Control Panel user lacking permissions can exploit the absence of an asset-view permission check. By providing an attacker-controlled assetId, an unauthorized user could obtain a signed fallback transform preview link for private assets. This flaw, affecting Craft CMS versions from 4.0.0-RC1 to 4.17.7 and from 5.0.0-RC1 to 5.9.13, poses a significant risk as it permits unauthorized access to potentially sensitive content. The issue has been resolved in versions 4.17.8 and 5.9.14.

References