Craft CMS versions 4.0.0-RC1 through 4.17.7 and 5.0.0-RC1 through 5.9.13 contain a missing authorization vulnerability in the assets/preview-thumb endpoint. This flaw allows Control Panel users without asset-view permission to obtain a signed fallback transform preview link for private assets by calling the endpoint with an attacker-controlled assetId. The vulnerability is fixed in versions 4.17.8 and 5.9.14.