CVE-2026-56384: Craft CMS Missing Authorization in Asset Preview Endpoint

Technical summary

CVE-2026-56384 is a missing authorization vulnerability (CWE-862) in Craft CMS's assets/preview-thumb endpoint. The endpoint generates preview HTML with signed fallback transform links without first validating that the requesting user has asset-view permission on the target asset. An authenticated Control Panel user can supply an arbitrary assetId parameter to retrieve preview content for private assets they should not access. The vulnerability affects Craft 4.0.0-RC1 through 4.17.7 and 5.0.0-RC1 through 5.9.13, with fixes released in 4.17.8 and 5.9.14 respectively.

Business impact

This vulnerability enables information disclosure of private digital assets to authenticated but unprivileged Control Panel users. Organizations using Craft CMS to manage confidential images, documents, or media files risk exposure if those assets are stored as 'private.' The threat is confined to internal misuse—an attacker would need legitimate Control Panel credentials—but the impact scales with asset sensitivity. Content isolation controls are a foundational security expectation in multi-user CMS platforms, and their bypass can undermine internal access policies and compliance frameworks.

Affected systems

Craft CMS versions 4.0.0-RC1 through 4.17.7 (4.x branch) and 5.0.0-RC1 through 5.9.13 (5.x branch) are affected. Systems running Craft 4.17.8 or later, or 5.9.14 or later, are patched. Installations that do not expose Control Panel access to untrusted users or do not use the private asset feature face reduced risk, though all affected versions should be treated as vulnerable until patched.

Exploitability

Exploitation is straightforward once an attacker has Control Panel credentials. No special attack complexity or user interaction is required; a single HTTP request to the assets/preview-thumb endpoint with a target assetId parameter will return the preview. The CVSS score of 4.3 reflects the requirement for prior authentication (PR:L) and limited scope of impact (confidentiality only). However, the ease of abuse and low barrier to discovery make this a practical risk in environments with loose Control Panel access controls or disgruntled insiders.

Remediation

Update Craft CMS to version 4.17.8 or later (for 4.x users) or 5.9.14 or later (for 5.x users). No workarounds are available short of patching. Verify your current version and plan an update within your normal maintenance window. Both patched versions are stable releases and should not introduce breaking changes. Prioritize this update if your Control Panel is accessible to contractors, third-party agencies, or users with limited privileges.

Patch guidance

1. Identify all Craft CMS instances and their current versions (check craft/composer.json or the Control Panel About page). 2. Back up your database and files before patching. 3. Update via Composer: 'composer require craftcms/cms:4.17.8' (or 5.9.14) and run 'php craft migrate/all'. 4. Test asset preview functionality and private asset access controls in a staging environment first. 5. Verify that only authorized users can preview private assets post-patch. Consult the official Craft CMS changelog for any breaking changes or migration notes specific to your version jump.

Detection guidance

Monitor Control Panel access logs for repeated calls to /admin/assets/preview-thumb with varying assetId parameters, particularly from users whose roles lack asset-view permissions. Implement alerting if a single session requests previews for more than a threshold number of distinct private assets in a short timeframe. Review Control Panel user activity in the past 30 days to identify whether this endpoint has been called by unauthorized users. If you suspect exploitation, audit the signed preview links in HTTP response logs to determine which assets may have been accessed.

Why prioritize this

Despite the medium CVSS score, this vulnerability merits prompt patching because it directly undermines content access controls in a multi-user system, exploitability is trivial, and the attack leaves minimal forensic evidence (preview links are time-limited but still viable during their window). Organizations managing sensitive media or relying on Craft CMS for confidential document repositories should prioritize this update within 2–4 weeks. Lower urgency if your Control Panel is restricted to a small, trusted team and private assets are minimal.

Risk score, explained

CVSS 4.3 (Medium) reflects the confluence of network-accessible endpoint (AV:N), low attack complexity (AC:L), requirement for valid credentials (PR:L), no user interaction (UI:N), and confidentiality impact limited to a single user's unauthorized view of private content (C:L/I:N/A:N). The score appropriately penalizes the authentication prerequisite; however, in environments with loose Control Panel access or high asset sensitivity, practical risk may exceed the numeric rating.

Frequently asked questions