MediumGHSA-3pvf-vxrv-hh9cCVE-2026-33158

Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)

Published 24 Mar 2026 · Updated 25 Mar 2026

Affected packages

craftcms/cmsComposer
Affected
>=4.0.0-RC1 <4.17.8
Fixed in
4.17.8
Update to the fixed version for your release line, for example:composer require craftcms/cms:^4.17.8
craftcms/cmsComposer
Affected
>=5.0.0-RC1 <5.9.14
Fixed in
5.9.14
Update to the fixed version for your release line, for example:composer require craftcms/cms:^5.9.14

Details

Summary

A low-privileged authenticated user can read private asset content by calling assets/edit-image with an arbitrary assetId that they are not authorized to view.

The endpoint returns image bytes (or a preview redirect) without enforcing a per-asset view authorization check, leading to potential unauthorized disclosure of private files.

Details

Root cause:

  • A user-controlled object reference (assetId) is used to load and return sensitive content.
  • The action does not verify whether the current user is authorized to view that asset.
  • This creates an authenticated IDOR / authorization bypass.

Impact

  • Craft installations where private/non-public assets exist and low-privileged users can authenticate.

Resources

https://github.com/craftcms/cms/commit/7290d91639e

Is GHSA-3pvf-vxrv-hh9c in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected craftcms/cms, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.