PT-2026-27466 · Craft Cms · Craft Cms

Susen2 · CVE-2026-33161 · Published 2026-03-24 · Updated 2026-03-24

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.17.7 Craft CMS versions 5.0.0-RC1 through 5.9.13

Description A low-privileged authenticated user can access editor response data, including focalPoint, for private assets they are not authorized to view. The /assets/image-editor API endpoint returns private editing metadata without proper authorization checks. The issue stems from the actionImageEditor() function accepting an assetId without validating the user's access rights to the corresponding asset before returning data such as html and focalPoint.

Recommendations Update to Craft CMS version 4.17.8 or later. Update to Craft CMS version 5.9.14 or later.

Exploit

Fix

Information Disclosure

Missing Authorization

Weakness Enumeration

CWE-200

CWE-862

Related Identifiers

CVE-2026-33161

GHSA-VGJG-248P-RFM2

Affected Products

Craft Cms

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33161.json · Exploit
• https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27 · Patch
• https://github.com/craftcms/cms/security/advisories/GHSA-vgjg-248p-rfm2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33161 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vgjg-248p-rfm2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33161 · Security Note
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/releases/tag/4.17.8 · Note
• https://github.com/craftcms/cms/releases/tag/5.9.14 · Note