CVE-2026-33158: Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)
Summary
A low-privileged authenticated user can read private asset content by calling assets/edit-image with an arbitrary assetId that they are not authorized to view.
The endpoint returns image bytes (or a preview redirect) without enforcing a per-asset view authorization check, leading to potential unauthorized disclosure of private files.
Details
Root cause: - A user-controlled object reference (assetId) is used to load and return sensitive content. - The action does not verify whether the current user is authorized to view that asset. - This creates an authenticated IDOR / authorization bypass.
Impact
- Craft installations where private/non-public assets exist and low-privileged users can authenticate.
Resources
https://github.com/craftcms/cms/commit/7290d91639e
Other sources
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-privileged authenticated user can read private asset content by calling assets/edit-image with an arbitrary assetId that they are not authorized to view. The endpoint returns image bytes (or a preview redirect) without enforcing a per-asset view authorization check, leading to potential unauthorized disclosure of private files. This issue has been patched in versions 4.17.8 and 5.9.14.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33158?
CVE-2026-33158 is classified as a medium severity vulnerability due to its potential impact on unauthorized access to private asset contents.
How do I fix CVE-2026-33158?
To fix CVE-2026-33158, upgrade to Craft CMS version 4.17.8 or 5.9.14 or later.
What kind of vulnerability is CVE-2026-33158?
CVE-2026-33158 is an Insecure Direct Object Reference (IDOR) vulnerability affecting asset management in Craft CMS.
Who is affected by CVE-2026-33158?
Low-privileged authenticated users in Craft CMS versions between 4.0.0-RC1 and 4.17.7, as well as 5.0.0-RC1 to 5.9.13, are affected by CVE-2026-33158.
What should I do if I cannot upgrade to the fixed version for CVE-2026-33158?
If upgrading is not feasible, implement access controls to prevent low-privileged users from accessing restricted asset endpoints.