Craft CMS versions 4.0.0-RC1 through 4.17.7 and 5.0.0-RC1 through 5.9.13 contain an authorization bypass vulnerability in the assets/preview-file endpoint. This flaw allows authenticated users with low privileges to retrieve preview metadata for assets they are not authorized to access. The vulnerability was fixed in versions 4.17.8 and 5.9.14. The CVSS score is 4.3, indicating a medium severity impact.