CVE-2026-84802: Craft CMS Information Disclosure Vulnerability

CVE-2026-84802 Overview

CVE-2026-84802 is an information disclosure vulnerability in Craft CMS affecting versions from 5.7.0 before 5.10.12. The flaw resides in the AssetsController::actionMoveInfo method, which fails to enforce volume permissions on incoming requests. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds and retrieve asset count and total storage size for volumes they are not authorized to access. The issue is classified under CWE-862: Missing Authorization.

Critical Impact
Authenticated attackers with any control panel access can enumerate metadata (asset counts and total storage size) for restricted asset volumes, exposing information about segregated tenants, customer data stores, or internal projects.

Affected Products

Craft CMS 5.7.0 through 5.10.11
Craft CMS control panel assets/move-info endpoint
Any Craft CMS deployment using volume-level access controls in the 5.7.0–5.10.11 range

Discovery Timeline

2026-09-02 - CVE-2026-84802 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84802

Vulnerability Analysis

Craft CMS partitions assets into volumes, each with its own permission model that controls which users can view, edit, or move files. The AssetsController::actionMoveInfo action returns metadata used by the control panel when previewing folder moves. In vulnerable releases, the action accepts a folderId parameter but does not verify that the requesting user has permission to view the corresponding volume.

The response returns aggregate metadata: the number of assets contained in the target folder and the cumulative storage size. While the underlying files are not exposed, the numeric metadata leaks information about restricted volumes. Attackers can iterate through folder IDs to profile private storage areas across tenants and projects.

Root Cause

The root cause is a missing authorization check in the controller action. The endpoint validates that the caller is authenticated to the control panel but does not call the volume permission subsystem to confirm the caller can access the folder referenced by folderId. This is a textbook CWE-862 missing authorization defect.

Attack Vector

Exploitation requires an authenticated control panel session. A low-privileged user issues POST requests to assets/move-info with a targeted folderId value. The server responds with the folder's asset count and total size, regardless of whether the caller has permission on the parent volume. See the GitHub Security Advisory GHSA-5mjc-jqcw-6vrp and the VulnCheck Advisory for full technical details.

No verified public exploit code is available. The vulnerability mechanism is described in prose because no realCodeExamples were supplied by upstream sources.

Detection Methods for CVE-2026-84802

Indicators of Compromise

POST requests to /index.php?p=admin/actions/assets/move-info or the equivalent action route from authenticated but low-privileged control panel users.
Sequential or high-volume requests to assets/move-info with varying folderId parameters indicating enumeration.
Control panel sessions submitting folderId values corresponding to volumes the user has no assigned permissions on.

Detection Strategies

Review Craft CMS web server access logs for repeated requests to the assets/move-info endpoint grouped by session or user ID.
Correlate authenticated user IDs against Craft's volume permission matrix to identify requests targeting unauthorized folderId values.
Baseline normal control panel usage patterns and alert on user accounts that suddenly issue bulk asset metadata queries.

Monitoring Recommendations

Ingest Craft CMS application and web server logs into a centralized analytics platform for correlation across sessions.
Add web application firewall (WAF) rules to log and rate-limit POST requests to assets/move-info.
Track user account activity for anomalous administrative actions following any successful control panel authentication.

How to Mitigate CVE-2026-84802

Immediate Actions Required

Upgrade Craft CMS to version 5.10.12 or later, which enforces volume permissions in AssetsController::actionMoveInfo.
Audit control panel user accounts and remove or downgrade accounts that do not require access.
Review recent access logs for assets/move-info requests to identify possible prior enumeration activity.

Patch Information

Craft CMS 5.10.12 resolves the vulnerability by adding volume permission enforcement to the actionMoveInfo handler. Upgrade instructions and the full fix are documented in the GitHub Security Advisory GHSA-5mjc-jqcw-6vrp.

Workarounds

Restrict control panel access by IP allow list at the reverse proxy or WAF layer until patching is complete.
Temporarily block or rate-limit the assets/move-info endpoint at the web server for non-administrative users.
Require multi-factor authentication for all control panel accounts to reduce the pool of accounts that could reach the endpoint.

bash

# Example nginx snippet to restrict the vulnerable endpoint by source IP
location ~* /admin/actions/assets/move-info {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://craftcms_upstream;
}