CVE-2026-56384: Craft CMS - Missing Authorization in assets/preview-thumb Endpoint
Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user without permission to view a target private asset can call the endpoint with an attacker-controlled assetId and receive preview HTML containing a signed fallback transform preview link for that private asset, because no asset-view permission check is performed before preview generation. This affects versions >= 4.0.0-RC1, <= 4.17.7 and >= 5.0.0-RC1, <= 5.9.13, and is fixed in 4.17.8 and 5.9.14.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 4.17.8 - Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.9.14
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56384?
CVE-2026-56384 has a medium severity rating of 4.3.
How do I fix CVE-2026-56384?
To fix CVE-2026-56384, ensure that appropriate authorization checks are implemented for the assets/preview-thumb endpoint.
What type of vulnerability is CVE-2026-56384?
CVE-2026-56384 is a missing authorization vulnerability affecting Craft CMS.
What is affected by CVE-2026-56384?
CVE-2026-56384 affects the assets/preview-thumb endpoint in Craft CMS.
Can an attacker exploit CVE-2026-56384 without proper user permissions?
Yes, an attacker can exploit CVE-2026-56384 by using an attacker-controlled assetId to bypass authorization checks.