PT-2026-7147 · Craft · Craft

Vitalysim · Published 2026-02-09 · Updated 2026-02-09 · CVE-2026-25497

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Craft versions 4.0.0-RC1 through 4.17.0-beta.1 Craft version 5.9.0-beta.1

Description Craft is a platform for creating digital experiences. A privilege escalation issue exists in the GraphQL API. An authenticated user with write access to one asset volume can escalate their privileges and modify or transfer assets belonging to any other volume, including restricted or private volumes. The saveAsset GraphQL mutation validates authorization against the schema-resolved volume but fetches the target asset by ID without verifying that the asset belongs to the authorized volume, enabling unauthorized cross-volume asset modification and transfer.

Recommendations Update to Craft version 4.17.0-beta.1 or later. Update to Craft version 5.9.0-beta.1 or later.

Exploit

Fix

LPE

IDOR

Improper Privilege Management

Weakness Enumeration

CWE-639

CWE-269

Related Identifiers

CVE-2026-25497

GHSA-FXP3-G6GW-4R4V

Affected Products

Craft

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25497.json · Exploit
• https://github.com/craftcms/cms/commit/ac7edf868c1a81fd9c4dc49d3b3edf1cce113409 · Patch
• https://github.com/craftcms/cms/security/advisories/GHSA-fxp3-g6gw-4r4v · Patch
• https://osv.dev/vulnerability/CVE-2026-25497 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25497 · Security Note
• https://osv.dev/vulnerability/GHSA-fxp3-g6gw-4r4v · Vendor Advisory
• https://github.com/craftcms/cms · Note
• https://github.com/craftcms/cms/releases/tag/5.8.22 · Note
• https://github.com/craftcms/cms/releases/tag/5.9.0-beta.1 · Note
• https://github.com/craftcms/cms/releases/tag/4.17.0-beta.1 · Note
• https://twitter.com/_cvereports/status/2020991120436506801 · Twitter Post
• https://twitter.com/CVEnew/status/2020959688062308746 · Twitter Post