LowGHSA-44px-qjjc-xrhqCVE-2026-56385

Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata

Published 26 Mar 2026 · Updated 6 Aug 2026

Affected packages

craftcms/cmsComposer

Affected: >=5.0.0-RC1 <5.9.14
Fixed in: 5.9.14

Update to the fixed version for your release line, for example:composer require craftcms/cms:^5.9.14

craftcms/cmsComposer

Affected: >=4.0.0-RC1 <4.17.8
Fixed in: 4.17.8

Update to the fixed version for your release line, for example:composer require craftcms/cms:^4.17.8

Details

Summary

An authenticated low-privileged user can call assets/preview-file for an asset they are not authorized to view and still receive preview response data (previewHtml) for that private asset.

The returned preview HTML included a private preview image route containing the target private assetId, even though canView was false for the attacker account.

Details

1. assets/preview-file accepts a maliciously controlled assetId and renders preview output. 2. The action does not enforce per-asset view authorization prior to returning preview content. 3. As a result, an authenticated user without asset-view permission can still obtain private preview output.

This affects Craft installations with authenticated users of mixed privilege levels with private assets.

Resources

d30df3112220db1ffd6726a3ed11857014c7fb27
b1cddf72c98a

Is GHSA-44px-qjjc-xrhq in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected craftcms/cms, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.