CVE-2026-56384: Craft CMS Auth Bypass Vulnerability

CVE-2026-56384 Overview

Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user without permission to view a target private asset can call the endpoint with an attacker-controlled assetId and receive preview HTML containing a signed fallback transform preview link for that private asset. The flaw exists because no asset-view permission check is performed before preview generation. The issue is tracked as CWE-862: Missing Authorization and affects Craft CMS versions >= 4.0.0-RC1, <= 4.17.7 and >= 5.0.0-RC1, <= 5.9.13. Fixes are available in 4.17.8 and 5.9.14.

Critical Impact
Authenticated Control Panel users can retrieve signed preview links for private assets they are not authorized to view, leading to disclosure of confidential file contents.

Affected Products

Craft CMS versions 4.0.0-RC1 through 4.17.7
Craft CMS versions 5.0.0-RC1 through 5.9.13
Craft CMS Control Panel assets/preview-thumb endpoint

Discovery Timeline

2026-06-21 - CVE-2026-56384 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-56384

Vulnerability Analysis

The vulnerability resides in the AssetsController of Craft CMS, specifically in the handler for the assets/preview-thumb endpoint. The endpoint accepts an assetId parameter and returns HTML containing a signed preview link for the referenced asset. The controller looks up the asset by ID but does not validate that the requesting Control Panel user has permission to view it.

An authenticated low-privilege user can iterate through asset identifiers and request preview HTML for any private asset stored in any volume. The response contains a signed fallback transform URL, allowing the attacker to retrieve preview thumbnails of files outside their authorization scope. This results in disclosure of confidential content stored in restricted volumes.

Root Cause

The root cause is a missing authorization check before preview generation [CWE-862]. The controller method located the asset and invoked getAssetPreviewHandler($asset) without first verifying volume-level view permissions. Specifically, neither viewAssets nor viewPeerAssets were enforced against the requesting user prior to generating and signing the preview link.

Attack Vector

Exploitation requires an authenticated Control Panel session with low privileges. The attacker sends a request to the assets/preview-thumb endpoint with an assetId corresponding to a private asset they do not own or have permission to view. Craft CMS responds with HTML containing a signed transform URL the attacker can fetch directly to obtain the preview.

php

             return $this->asFailure(Craft::t('app', 'Asset not found with that id'));
         }
 
+        $this->requireVolumePermissionByAsset('viewAssets', $asset);
+        $this->requirePeerVolumePermissionByAsset('viewPeerAssets', $asset);
+
         $previewHtml = null;
 
         $previewHandler = Craft::$app->getAssets()->getAssetPreviewHandler($asset);

Source: Craft CMS security patch commit d30df31. The patch inserts two explicit authorization calls — requireVolumePermissionByAsset('viewAssets', $asset) and requirePeerVolumePermissionByAsset('viewPeerAssets', $asset) — before any preview HTML is generated, ensuring the requester holds both the volume view and peer-view permissions.

Detection Methods for CVE-2026-56384

Indicators of Compromise

Repeated requests to /admin/actions/assets/preview-thumb from a single Control Panel user enumerating sequential assetId values.
Control Panel user accounts retrieving preview HTML for assets in volumes they have never accessed through normal navigation.
Outbound fetches of signed transform URLs immediately following preview-thumb responses to the same user session.

Detection Strategies

Audit Craft CMS web server logs for assets/preview-thumb calls and correlate the assetId parameter with the requesting user's permitted volumes.
Alert on Control Panel users whose assetId request distribution spans volumes outside their assigned permission set.
Compare request rate baselines against historical norms to surface enumeration patterns against the preview endpoint.

Monitoring Recommendations

Forward Craft CMS application and access logs to a centralized SIEM or log analytics platform for retention and correlation.
Track Control Panel session activity tied to user role, including endpoint and parameter usage, to detect privilege boundary violations.
Monitor volume-level asset access patterns and flag deviations following any Craft CMS version below 4.17.8 or 5.9.14.

How to Mitigate CVE-2026-56384

Immediate Actions Required

Upgrade Craft CMS to version 4.17.8 (for the 4.x branch) or 5.9.14 (for the 5.x branch) without delay.
Review Control Panel user accounts and remove or downgrade any accounts that do not require active access.
Audit recent assets/preview-thumb activity to identify potential unauthorized access to private assets.

Patch Information

Craft CMS released fixed versions 4.17.8 and 5.9.14 containing the authorization checks shown in commit d30df31. Additional context is available in the Craft CMS GitHub Security Advisory GHSA-x76w-8c62-48mg and the VulnCheck Advisory.

Workarounds

Restrict Control Panel access to trusted administrators using network-level controls such as IP allowlisting or VPN-gated access.
Tighten volume permissions so that low-privilege users cannot rely on default viewPeerAssets grants on sensitive volumes.
Place a web application firewall rule in front of /admin/actions/assets/preview-thumb to rate-limit requests per session until patching is complete.

bash

# Update Craft CMS via Composer to a patched release
composer require craftcms/cms:^5.9.14 --update-with-dependencies
# Or, for the 4.x branch
composer require craftcms/cms:^4.17.8 --update-with-dependencies

# Clear caches and apply any pending migrations
php craft clear-caches/all
php craft migrate/all