Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-sa99-8awj-eycd
Vulnerability ID VCID-sa99-8awj-eycd
Aliases GHSA-44px-qjjc-xrhq
Summary Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata ### Summary An authenticated low-privileged user can call `assets/preview-file` for an asset they are not authorized to view and still receive preview response data (`previewHtml`) for that private asset. The returned preview HTML included a private preview image route containing the target private `assetId`, even though `canView` was `false` for the attacker account. ### Details 1. `assets/preview-file` accepts a maliciously controlled `assetId` and renders preview output. 2. The action does not enforce per-asset view authorization prior to returning preview content. 3. As a result, an authenticated user without asset-view permission can still obtain private preview output. This affects Craft installations with authenticated users of mixed privilege levels with private assets. ### Resources - d30df3112220db1ffd6726a3ed11857014c7fb27 - b1cddf72c98a
Status Published
Exploitability 0.5
Weighted Severity 2.7
Risk 1.4
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-639 Authorization Bypass Through User-Controlled Key
CWE-862 Missing Authorization
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv4 1.3 https://github.com/craftcms/cms
generic_textual LOW https://github.com/craftcms/cms
cvssv4 1.3 https://github.com/craftcms/cms/commit/b1cddf72c98a66801beb04ea4b07e72182b7b7db
generic_textual LOW https://github.com/craftcms/cms/commit/b1cddf72c98a66801beb04ea4b07e72182b7b7db
cvssv4 1.3 https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27
generic_textual LOW https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27
cvssv4 1.3 https://github.com/craftcms/cms/security/advisories/GHSA-44px-qjjc-xrhq
generic_textual LOW https://github.com/craftcms/cms/security/advisories/GHSA-44px-qjjc-xrhq
Reference id Reference type URL
https://github.com/craftcms/cms
https://github.com/craftcms/cms/commit/b1cddf72c98a66801beb04ea4b07e72182b7b7db
https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27
https://github.com/craftcms/cms/security/advisories/GHSA-44px-qjjc-xrhq
GHSA-44px-qjjc-xrhq https://github.com/advisories/GHSA-44px-qjjc-xrhq
No exploits are available.
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U Found at https://github.com/craftcms/cms
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U Found at https://github.com/craftcms/cms/commit/b1cddf72c98a66801beb04ea4b07e72182b7b7db
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U Found at https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U Found at https://github.com/craftcms/cms/security/advisories/GHSA-44px-qjjc-xrhq
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2026-06-04T17:00:02.932647+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-44px-qjjc-xrhq/GHSA-44px-qjjc-xrhq.json 38.6.0