|
Vulnerabilities
< Back

GHSA-44px-qjjc-xrhq

Updated on 26 Mar 2026

Severity

Awaiting Analysis

Details

Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

Summary

An authenticated low-privileged user can call assets/preview-file for an asset they are not authorized to view and still receive preview response data (previewHtml) for that private asset.

The returned preview HTML included a private preview image route containing the target private assetId, even though canView was false for the attacker account.

Details

  1. assets/preview-file accepts a maliciously controlled assetId and renders preview output.
  2. The action does not enforce per-asset view authorization prior to returning preview content.
  3. As a result, an authenticated user without asset-view permission can still obtain private preview output.

This affects Craft installations with authenticated users of mixed privilege levels with private assets.

Resources

  • d30df3112220db1ffd6726a3ed11857014c7fb27
  • b1cddf72c98a

Details

Affected product:
craftcms/cms , craftcms/feed-me , verbb/feed-me
Affected packages:
feed-me @ 3.1.17 (+2 more)

Fixes