Duplicate Advisory: Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata
Craft CMS versions 4.0.0-RC1 through 4.17.7 and 5.0.0-RC1 through 5.9.13 contain an authorization bypass vulnerability in the assets/preview-file endpoint. This flaw allows authenticated users with low privileges to retrieve preview metadata for assets they are not authorized to access. The vulnerability was fixed in versions 4.17.8 and 5.9.14. The CVSS score is 4.3, indicating a medium severity impact.
AI Analysis
Technical Summary
Craft CMS versions >=4.0.0-RC1 and <=4.17.7, and >=5.0.0-RC1 and <=5.9.13 have an authorization bypass in the assets/preview-file endpoint. The endpoint does not enforce per-asset view authorization before returning preview content, enabling authenticated low-privileged users to supply an assetId for an asset they cannot view and receive previewHtml data, including private preview image routes referencing the private assetId. This issue is tracked as CWE-639 and was fixed in versions 4.17.8 and 5.9.14.
Potential Impact
An authenticated user with low privileges can bypass authorization controls to access preview metadata of private assets they are not permitted to view. This exposure is limited to preview content and does not affect asset integrity or availability. The confidentiality of private asset metadata is compromised, but no integrity or availability impacts are reported.
Mitigation Recommendations
Update Craft CMS to version 4.17.8 or later, or 5.9.14 or later to apply the official fix for this authorization bypass vulnerability. No other mitigation steps are indicated by the vendor advisory.
Duplicate Advisory: Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata
Description
Craft CMS versions 4.0.0-RC1 through 4.17.7 and 5.0.0-RC1 through 5.9.13 contain an authorization bypass vulnerability in the assets/preview-file endpoint. This flaw allows authenticated users with low privileges to retrieve preview metadata for assets they are not authorized to access. The vulnerability was fixed in versions 4.17.8 and 5.9.14. The CVSS score is 4.3, indicating a medium severity impact.
CVSS v3.1
Score 4.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Craft CMS versions >=4.0.0-RC1 and <=4.17.7, and >=5.0.0-RC1 and <=5.9.13 have an authorization bypass in the assets/preview-file endpoint. The endpoint does not enforce per-asset view authorization before returning preview content, enabling authenticated low-privileged users to supply an assetId for an asset they cannot view and receive previewHtml data, including private preview image routes referencing the private assetId. This issue is tracked as CWE-639 and was fixed in versions 4.17.8 and 5.9.14.
Potential Impact
An authenticated user with low privileges can bypass authorization controls to access preview metadata of private assets they are not permitted to view. This exposure is limited to preview content and does not affect asset integrity or availability. The confidentiality of private asset metadata is compromised, but no integrity or availability impacts are reported.
Mitigation Recommendations
Update Craft CMS to version 4.17.8 or later, or 5.9.14 or later to apply the official fix for this authorization bypass vulnerability. No other mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-f4h3-qhg5-j6mq
- Osv Schema Version
- 1.4.0
- Aliases
- []
- Ecosystems
- ["Packagist"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a7573b7bf8831d539d93f27
Added to database: 08/07/2026, 05:57:11 UTC
Last enriched: 08/07/2026, 07:16:49 UTC
Last updated: 08/08/2026, 01:06:15 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.