CVE-2026-24749: Silverstripe Assets Auth Bypass Flaw

CVE-2026-24749 Overview

CVE-2026-24749 is an Authorization Bypass vulnerability in the Silverstripe Assets Module, a required component of the Silverstripe Framework. The vulnerability exists in how the module handles access grants when rendering images in templates or accessing files through DBFile::getURL() or DBFile::getSourceURL() methods. When images are rendered or file variants are created (such as using manipulation methods like ScaleWidth() or Convert()), the system incorrectly adds an access grant to the current session, effectively bypassing the configured file permissions.

Critical Impact

Protected files can be accessed without proper authorization when image variants are created, allowing unauthorized users to bypass file permission controls.

Affected Products

• Silverstripe Assets Module versions prior to 2.4.5
• Silverstripe Assets Module versions 3.0.0-rc1 through 3.1.2

Discovery Timeline

• April 16, 2026 - CVE CVE-2026-24749 published to NVD
• April 16, 2026 - Last updated in NVD database

Technical Details for CVE-2026-24749

Vulnerability Analysis

This vulnerability represents an Improper Authorization (CWE-863) flaw in the Silverstripe Assets Module's file access control mechanism. The core issue lies in how the module manages session-based access grants when files are processed or manipulated.

When a protected file is accessed through template rendering or the DBFile::getURL() and DBFile::getSourceURL() methods, the system incorrectly grants access to the current session regardless of whether the user should have permission to view the file. This behavior is particularly triggered during image manipulation operations such as creating scaled versions or format conversions.

The vulnerability allows network-based attackers to access protected files without authentication by leveraging the improper access grant mechanism. While the confidentiality impact is limited to the exposed files, this could lead to unauthorized access to sensitive assets that were intended to be protected.

Root Cause

The root cause is improper implementation of the access control logic in the file handling subsystem. When image variants are created or files are accessed through the affected methods, the code path incorrectly adds an access grant to the session without properly validating whether the user has the appropriate permissions. This breaks the intended security model where "protected" visibility files should require explicit authorization.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker can exploit this vulnerability by:

1. Identifying protected files on a Silverstripe installation
2. Requesting image variants or accessing files through URLs that trigger the vulnerable code paths
3. Exploiting the incorrectly granted session access to retrieve protected content

The vulnerability can be triggered when the application renders images in templates or when developers use DBFile directly in the $db configuration for DataObject classes with "protected" visibility settings.

Detection Methods for CVE-2026-24749

Indicators of Compromise

• Unexpected access logs showing requests to protected file URLs from unauthenticated sessions
• Anomalous patterns of image variant requests from suspicious IP addresses
• Session data showing access grants that were not explicitly configured

Detection Strategies

• Monitor web server access logs for requests to /assets/ paths that should require authentication
• Implement logging for DBFile::getURL() and DBFile::getSourceURL() method calls to track access patterns
• Review session data for unexpected access grants to protected files
• Audit file access patterns against expected user permissions

Monitoring Recommendations

• Enable detailed logging for file access operations in Silverstripe
• Set up alerts for access to protected file directories from sessions without proper authentication
• Monitor for bulk download attempts or automated scanning of asset directories
• Review application logs for image manipulation operations on protected files

How to Mitigate CVE-2026-24749

Immediate Actions Required

• Upgrade Silverstripe Assets Module to version 2.4.5 or 3.1.3 immediately
• Audit existing protected files to identify any potential unauthorized access
• Review file visibility configurations across all DataObject classes using DBFile
• Implement additional access controls at the web server level for sensitive assets

Patch Information

Silverstripe has released fixed versions that address this vulnerability. Users should upgrade to:

• Version 2.4.5 for the 2.x branch
• Version 3.1.3 for the 3.x branch

For detailed information, refer to the GitHub Security Advisory and the Silverstripe Security Release.

Workarounds

• For DataObject classes using DBFile directly with "protected" visibility, implement explicit access grants in application code before upgrading
• Consider changing file visibility to "public" for files that do not require protection and should be accessible by default
• Implement web server-level access controls (such as .htaccess rules or nginx configurations) as an additional defense layer
• Restrict access to the /assets/ directory at the network level for highly sensitive installations

# Example: Restrict access to protected assets directory in nginx
location /assets/.protected/ {
    deny all;
    return 403;
}

# Example: Add authentication requirement for protected assets in Apache
<Directory "/var/www/html/assets/.protected">
    AuthType Basic
    AuthName "Protected Assets"
    AuthUserFile /etc/apache2/.htpasswd
    Require valid-user
</Directory>