---
id: GHSA-x76w-8c62-48mg
title: >-
  Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback
  transform preview link to CP users without asset-view permission
summary: >-
  Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback
  transform preview link to CP users without asset-view permission
severity: medium
cwe:
  - CWE-200
  - CWE-862
vendor: craftcms
product: craftcms/cms
ecosystem: composer
affected:
  - 'craftcms/cms >= 4.0.0-RC1, <= 4.17.7'
  - 'craftcms/cms >= 5.0.0-RC1, <= 5.9.13'
patched:
  - craftcms/cms 4.17.8
  - craftcms/cms 5.9.14
published: '2026-07-06'
updated: '2026-07-06'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-x76w-8c62-48mg'
references:
  - url: 'https://github.com/craftcms/cms/security/advisories/GHSA-x76w-8c62-48mg'
  - url: >-
      https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27
  - url: 'https://github.com/advisories/GHSA-x76w-8c62-48mg'
tags:
  - ghsa
  - composer
ingestedAt: '2026-07-06T20:46:12.654Z'
---

## Overview

### Summary

A user with Control Panel access but without permission to view a target private asset can call `assets/preview-thumb` and receive preview HTML that contains a signed fallback transform link for that private asset.

### Details

Root-cause analysis:
1. The endpoint accepts an attacker-controlled `assetId`.
2. Asset is resolved, and thumbnail HTML is returned.
3. No explicit asset-view permission check is performed before preview generation.

### Impact

Type:

1. Missing authorization
2. Unauthorized preview-link disclosure

  Affected deployments:

1. Craft sites with control panel users who have partial permissions and private assets.

  Security consequence:

  1. A control panel user without asset-view permission can still obtain signed preview transform link data for private assets.
  2. This may increase private asset exposure risk depending on deployment and endpoint chaining.

## Resources

https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27

## Affected packages

- `craftcms/cms >= 4.0.0-RC1, <= 4.17.7`
- `craftcms/cms >= 5.0.0-RC1, <= 5.9.13`

## Remediation

Upgrade to a patched release:

- `craftcms/cms 4.17.8`
- `craftcms/cms 5.9.14`