CVE-2026-56385: Craft CMS Authorization Bypass Vulnerability

CVE-2026-56385 Overview

CVE-2026-56385 is an authorization bypass vulnerability in the Craft CMS assets/preview-file endpoint. The flaw affects Craft CMS versions >= 5.0.0-RC1, <= 5.9.13 and >= 4.0.0-RC1, <= 4.17.7. The endpoint fails to enforce per-asset view authorization before returning preview content. An authenticated low-privileged user can supply a controlled assetId for an asset they are not permitted to view and still receive preview response data, including a private preview image route containing the target private assetId. The issue is categorized as Insecure Direct Object Reference [CWE-639]. Craft CMS resolved the issue in versions 5.9.14 and 4.17.8.

Critical Impact
Authenticated low-privileged users can retrieve preview content and private asset identifiers for assets outside their authorization scope.

Affected Products

Craft CMS 5.0.0-RC1 through 5.9.13
Craft CMS 4.0.0-RC1 through 4.17.7
Patched releases: 5.9.14 and 4.17.8

Discovery Timeline

2026-06-21 - CVE-2026-56385 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-56385

Vulnerability Analysis

The vulnerability resides in the AssetsController of Craft CMS, specifically in the action backing the assets/preview-file endpoint. The controller resolves the requested asset by the user-supplied assetId but does not validate whether the requesting user holds the viewAssets or viewPeerAssets volume permissions for that asset. As a result, the controller returns a previewHtml payload that references a private preview image route embedding the target assetId. This exposes content and identifiers that should be restricted by per-volume access control.

Root Cause

The root cause is missing authorization checks on a direct object reference [CWE-639]. The endpoint trusts the supplied assetId parameter without verifying volume-level view permissions. Authentication alone is treated as sufficient, allowing horizontal access to assets owned by other users or stored in volumes the caller cannot access.

Attack Vector

Exploitation requires network access to the Craft CMS control panel and a valid low-privileged authenticated session. The attacker issues a request to assets/preview-file with an assetId belonging to a restricted asset. The server returns the preview HTML and a private preview image URL, disclosing confidential file content and metadata.

php

            return $this->asFailure(Craft::t('app', 'Asset not found with that id'));
        }

+        $this->requireVolumePermissionByAsset('viewAssets', $asset);
+        $this->requirePeerVolumePermissionByAsset('viewPeerAssets', $asset);
+
        $previewHtml = null;

        $previewHandler = Craft::$app->getAssets()->getAssetPreviewHandler($asset);

Source: Craft CMS patch commit d30df31. The patch adds explicit requireVolumePermissionByAsset and requirePeerVolumePermissionByAsset checks before generating preview output.

Detection Methods for CVE-2026-56385

Indicators of Compromise

Authenticated requests to /index.php?p=admin/actions/assets/preview-file from low-privileged accounts referencing assetId values they do not own.
Sequential or enumerative assetId parameter values originating from a single session.
Successful HTTP 200 responses containing previewHtml payloads served to users without matching volume permissions.

Detection Strategies

Correlate web access logs for the assets/preview-file action with the authenticated user's permitted volumes and asset ownership.
Alert when the same session requests preview output for assetId ranges that span multiple volumes or owners within a short window.
Review application audit logs for asset preview actions that do not align with documented user roles.

Monitoring Recommendations

Capture and retain Craft CMS control panel access logs, including query parameters, in a centralized log store.
Monitor for spikes in assets/preview-file traffic following public disclosure of the advisory.
Track the installed Craft CMS version across environments and alert when instances remain below 5.9.14 or 4.17.8.

How to Mitigate CVE-2026-56385

Immediate Actions Required

Upgrade Craft CMS to 5.9.14 or 4.17.8, depending on the branch in use.
Audit existing user accounts and remove unused low-privileged control panel sessions.
Review volume and peer-volume permission assignments to confirm least-privilege configuration.

Patch Information

The fix is delivered in Craft CMS 5.9.14 and 4.17.8. The patch adds requireVolumePermissionByAsset('viewAssets', $asset) and requirePeerVolumePermissionByAsset('viewPeerAssets', $asset) checks inside the assets/preview-file action handler. See the GitHub Security Advisory GHSA-44px-qjjc-xrhq and the VulnCheck Advisory for additional context.

Workarounds

Restrict control panel access to trusted networks using web server or WAF rules until patching is complete.
Block or rate-limit requests to the assets/preview-file action for accounts that do not require asset preview functionality.
Temporarily disable low-privileged accounts that do not need control panel access.

bash

# Upgrade Craft CMS using Composer
composer require craftcms/cms:^5.9.14 --update-with-dependencies
# Or for the 4.x branch
composer require craftcms/cms:^4.17.8 --update-with-dependencies
php craft up