{"id":"GHSA-x76w-8c62-48mg","title":"Craft CMS: Authenticated \"assets/preview-thumb\" discloses signed fallback transform preview link to CP users without asset-view permission","summary":"Craft CMS: Authenticated \"assets/preview-thumb\" discloses signed fallback transform preview link to CP users without asset-view permission","severity":"medium","cwe":["CWE-200","CWE-862"],"vendor":"craftcms","product":"craftcms/cms","ecosystem":"composer","affected":["craftcms/cms >= 4.0.0-RC1, <= 4.17.7","craftcms/cms >= 5.0.0-RC1, <= 5.9.13"],"patched":["craftcms/cms 4.17.8","craftcms/cms 5.9.14"],"published":"2026-07-06","updated":"2026-07-06","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-x76w-8c62-48mg","references":[{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-x76w-8c62-48mg"},{"url":"https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27"},{"url":"https://github.com/advisories/GHSA-x76w-8c62-48mg"}],"tags":["ghsa","composer"],"ingestedAt":"2026-07-06T20:46:12.654Z","slug":"GHSA-x76w-8c62-48mg","body":"## Overview\n\n### Summary\n\nA user with Control Panel access but without permission to view a target private asset can call `assets/preview-thumb` and receive preview HTML that contains a signed fallback transform link for that private asset.\n\n### Details\n\nRoot-cause analysis:\n1. The endpoint accepts an attacker-controlled `assetId`.\n2. Asset is resolved, and thumbnail HTML is returned.\n3. No explicit asset-view permission check is performed before preview generation.\n\n### Impact\n\nType:\n\n1. Missing authorization\n2. Unauthorized preview-link disclosure\n\n  Affected deployments:\n\n1. Craft sites with control panel users who have partial permissions and private assets.\n\n  Security consequence:\n\n  1. A control panel user without asset-view permission can still obtain signed preview transform link data for private assets.\n  2. This may increase private asset exposure risk depending on deployment and endpoint chaining.\n\n## Resources\n\nhttps://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27\n\n## Affected packages\n\n- `craftcms/cms >= 4.0.0-RC1, <= 4.17.7`\n- `craftcms/cms >= 5.0.0-RC1, <= 5.9.13`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `craftcms/cms 4.17.8`\n- `craftcms/cms 5.9.14`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}