GHSA-X76W-8C62-48MG

Vulnerability from github – Published: 2026-07-06 20:28 – Updated: 2026-08-06 21:06
VLAI
Summary
Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission
Details

Summary

A user with Control Panel access but without permission to view a target private asset can call assets/preview-thumb and receive preview HTML that contains a signed fallback transform link for that private asset.

Details

Root-cause analysis: 1. The endpoint accepts an attacker-controlled assetId. 2. Asset is resolved, and thumbnail HTML is returned. 3. No explicit asset-view permission check is performed before preview generation.

Impact

Type:

  1. Missing authorization
  2. Unauthorized preview-link disclosure

Affected deployments:

  1. Craft sites with control panel users who have partial permissions and private assets.

Security consequence:

  1. A control panel user without asset-view permission can still obtain signed preview transform link data for private assets.
  2. This may increase private asset exposure risk depending on deployment and endpoint chaining.

Resources

https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27

Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.17.7"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0-RC1"
            },
            {
              "fixed": "4.17.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.9.13"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-RC1"
            },
            {
              "fixed": "5.9.14"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-56384"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-06T20:28:07Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nA user with Control Panel access but without permission to view a target private asset can call `assets/preview-thumb` and receive preview HTML that contains a signed fallback transform link for that private asset.\n\n### Details\n\nRoot-cause analysis:\n1. The endpoint accepts an attacker-controlled `assetId`.\n2. Asset is resolved, and thumbnail HTML is returned.\n3. No explicit asset-view permission check is performed before preview generation.\n\n### Impact\n\nType:\n\n1. Missing authorization\n2. Unauthorized preview-link disclosure\n\n  Affected deployments:\n\n1. Craft sites with control panel users who have partial permissions and private assets.\n\n  Security consequence:\n\n  1. A control panel user without asset-view permission can still obtain signed preview transform link data for private assets.\n  2. This may increase private asset exposure risk depending on deployment and endpoint chaining.\n\n## Resources\n\nhttps://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27",
  "id": "GHSA-x76w-8c62-48mg",
  "modified": "2026-08-06T21:06:17Z",
  "published": "2026-07-06T20:28:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-x76w-8c62-48mg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56384"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/craftcms/cms"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/craft-cms-missing-authorization-in-assets-preview-thumb-endpoint"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Craft CMS: Authenticated \"assets/preview-thumb\" discloses signed fallback transform preview link to CP users without asset-view permission"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.