CVE-2026-56385: Craft CMS Authorization Bypass in Asset Preview Endpoint

Technical summary

The assets/preview-file endpoint in Craft CMS lacks per-asset authorization checks before returning preview content. Although the endpoint requires user authentication (PR:L), it fails to verify that the authenticated user has view permissions on the specific asset identified by the assetId parameter. When a request is processed, the endpoint returns previewHtml and constructs a private preview image route containing the target assetId, effectively leaking both metadata and access paths to unauthorized assets. This authorization bypass exists in both the 5.x and 4.x maintenance branches through the specified patch dates.

Business impact

The vulnerability exposes sensitive asset content (images, documents, or other media) to authenticated users who lack permission to view them. Organizations using Craft CMS for content management with role-based access controls may have confidential or proprietary assets inadvertently exposed to internal users with lower privilege levels. The impact is limited to information disclosure—no data modification or denial of service is possible—but can compromise content confidentiality if assets contain sensitive information. The requirement for prior authentication raises the barrier to exploitation, reducing risk for organizations with strong access controls.

Affected systems

Craft CMS versions 5.0.0-RC1 through 5.9.13 and 4.0.0-RC1 through 4.17.8 are affected. The vulnerability spans both major version lines actively in use. Organizations running Craft CMS should check their current version against these ranges. Version 5.9.14 and 4.17.8 (and later) contain the fix.

Exploitability

Exploitation requires an authenticated Craft CMS user account with any privilege level above complete guest access. An attacker does not need network complexity or user interaction—a direct API request with a target assetId is sufficient. The attack is straightforward: an authenticated low-privileged user crafts a request to assets/preview-file with an assetId for a restricted asset, receives the preview response, and gains access to preview HTML and private image routes. No account privilege escalation, complex chaining, or social engineering is necessary beyond gaining initial authentication. This makes it a risk for multi-tenant or team-based Craft CMS deployments where user accounts are widely distributed.

Remediation

Organizations should upgrade to Craft CMS 5.9.14 or 4.17.8 (or later versions in each branch) immediately. Both versions apply authorization checks to the assets/preview-file endpoint before returning preview data. Verify the patch version in your Craft CMS installation via the control panel or by inspecting the version constant in the codebase. For organizations unable to patch immediately, consider restricting API access to the assets/preview-file endpoint via reverse proxy or WAF rules to trusted client IP ranges or authentication tokens, although this is a temporary measure pending patching.

Patch guidance

Craft CMS 5.x users should upgrade to 5.9.14 or later. Craft CMS 4.x users should upgrade to 4.17.8 or later. Both patches are maintenance releases and should be low-risk deployments. Before patching production, test in a staging environment to ensure compatibility with any custom plugins or extensions that may interact with asset preview functionality. Review release notes for any breaking changes, though authorization-focused patches typically carry minimal compatibility risk. Consider scheduling patches during a maintenance window if your CMS hosts time-sensitive content workflows.

Detection guidance

Monitor authentication logs for authenticated users accessing the assets/preview-file endpoint with assetIds they do not own or have not been granted access to. Examine request patterns for repeated attempts to enumerate assetIds outside the requester's normal workflow. Log analysis tools or a SIEM can flag requests to this endpoint from low-privilege accounts accessing a diverse range of asset identifiers. Additionally, review access logs for requests that return 200 OK responses to asset preview requests by users without documented asset view permissions. Conduct a post-incident audit of asset preview access logs to identify if unauthorized previews have been retrieved.

Why prioritize this

Although this is a MEDIUM-severity vulnerability, prioritization depends on your Craft CMS deployment model. Organizations with multi-user Craft CMS instances where sensitive content is stored and access control is enforced should patch promptly, as the low barrier to exploitation means any authenticated internal or contract user can probe for restricted assets. Single-administrator or small-team CMS deployments face lower practical risk. The lack of KEV status (not yet in active exploitation databases) provides a short window before broad awareness; patching sooner rather than later is prudent.

Risk score, explained

CVSS 3.1 score of 4.3 (MEDIUM) reflects low attack complexity, low privilege requirements for an attacker, and limited impact (confidentiality only, no integrity or availability). The score appropriately captures that exploitation is straightforward and requires only authentication, but the impact is restricted to information disclosure. Organizations should not discount this as 'low risk' simply because the CVSS score is below 5.0; in contexts where asset confidentiality is critical, the practical impact may warrant urgent patching.

Frequently asked questions