CVE-2026-84802: Missing Authorization in craftcms cms
Description
Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to retrieve asset count and total storage size for volumes they cannot access.
CVSS v4.0
Score 5.3medium
Affected software
craftcms
cms
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-84802 is an information disclosure vulnerability in Craft CMS affecting versions from 5.7.0 up to but not including 5.10.12. The flaw exists in the AssetsController::actionMoveInfo method, which fails to enforce volume permissions properly. Authenticated users with control panel access can send POST requests to the assets/move-info endpoint with arbitrary folderIds, allowing them to retrieve asset count and total storage size information for volumes they are not authorized to access.
Potential Impact
The vulnerability allows authenticated control panel users to access metadata about assets in unauthorized volumes, specifically asset counts and storage sizes. This could lead to unauthorized disclosure of information about the contents and usage of restricted volumes. There is no indication of further privilege escalation or data modification from the provided data.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions from 5.7.0 before 5.10.12, upgrading to version 5.10.12 or later is likely recommended once a fix is available. Until then, restrict control panel user permissions to trusted users and monitor for unusual access patterns to the assets/move-info endpoint.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-02T10:19:32.991Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a980704acd9273b492a91d0
Added to database: 09/02/2026, 11:22:44 UTC
Last enriched: 09/07/2026, 14:02:08 UTC
Last updated: 10/17/2026, 18:48:23 UTC
Views: 67
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.