PT-2026-51232 · Craft Cms · Cms

Susen2 · Published 2026-06-21 · Updated 2026-06-21 · CVE-2026-56384

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.17.7 Craft CMS versions 5.0.0-RC1 through 5.9.13

Description A missing authorization issue exists in the 'assets/preview-thumb' endpoint. A Control Panel user lacking permissions to view a specific private asset can provide a controlled assetId to the endpoint. This allows the user to receive preview HTML containing a signed fallback transform preview link for that private asset, as the system fails to perform an asset-view permission check before generating the preview.

Recommendations Update to version 4.17.8 for versions in the 4.x branch. Update to version 5.9.14 for versions in the 5.x branch.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-56384

Affected Products

Cms

References · 5

• https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27 · Patch
• https://github.com/craftcms/cms/security/advisories/GHSA-x76w-8c62-48mg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56384 · Security Note
• https://twitter.com/VulmonFeeds/status/2068710859476492700 · Twitter Post
• https://vulncheck.com/advisories/craft-cms-missing-authorization-in-assets-preview-thumb-endpoint · Note