CVE-2026-84802: Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController
Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to retrieve asset count and total storage size for volumes they cannot access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.10.12
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated Craft CMS control panel user can exploit it. The user only needs to send POST requests to the assets/move-info endpoint with chosen folderId values.
What information can be exposed?
An attacker can retrieve the asset count and total storage size for volumes that the authenticated user is not permitted to access. The provided information does not indicate exposure of the underlying asset contents.
Are default permissions sufficient to prevent exploitation?
No. The vulnerability is specifically caused by AssetsController::actionMoveInfo failing to enforce volume permissions, so users can query volumes they cannot normally access.
Which versions need remediation?
Craft CMS versions from 5.7.0 through versions before 5.10.12 are affected. Upgrading to 5.10.12 or later addresses the affected version range.