GHSA-44px-qjjc-xrhq
Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata
Quick fix
GHSA-44px-qjjc-xrhq — craftcms/cms: upgrade to the fixed version with the command below.
composer require craftcms/cms:^5.9.14Details
### Summary
An authenticated low-privileged user can call `assets/preview-file` for an asset they are not authorized to view and still receive preview response data (`previewHtml`) for that private asset.
The returned preview HTML included a private preview image route containing the target private `assetId`, even though `canView` was `false` for the attacker account.
### Details
1. `assets/preview-file` accepts a maliciously controlled `assetId` and renders preview output. 2. The action does not enforce per-asset view authorization prior to returning preview content. 3. As a result, an authenticated user without asset-view permission can still obtain private preview output.
This affects Craft installations with authenticated users of mixed privilege levels with private assets.
### Resources
- d30df3112220db1ffd6726a3ed11857014c7fb27 - b1cddf72c98a
Are you affected?
Enter the version of the package you're using.
Affected packages
5.0.0-RC1 Fixed in: 5.9.14 composer require craftcms/cms:^5.9.14 4.0.0-RC1 Fixed in: 4.17.8 composer require craftcms/cms:^4.17.8 References
- https://github.com/craftcms/cms/security/advisories/GHSA-44px-qjjc-xrhq [WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2026-56385 [ADVISORY]
- https://github.com/craftcms/cms/commit/b1cddf72c98a66801beb04ea4b07e72182b7b7db [WEB]
- https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27 [WEB]
- https://github.com/craftcms/cms [PACKAGE]
- https://www.vulncheck.com/advisories/craft-cms-authorization-bypass-in-assets-preview-file-endpoint [WEB]