Описание
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)
Summary
A low-privileged authenticated user can read private asset content by calling assets/edit-image with an arbitrary assetId that they are not authorized to view.
The endpoint returns image bytes (or a preview redirect) without enforcing a per-asset view authorization check, leading to potential unauthorized disclosure of private files.
Details
Root cause:
- A user-controlled object reference (
assetId) is used to load and return sensitive content. - The action does not verify whether the current user is authorized to view that asset.
- This creates an authenticated IDOR / authorization bypass.
Impact
- Craft installations where private/non-public assets exist and low-privileged users can authenticate.
Resources
Ссылки
Пакеты
craftcms/cms
>= 4.0.0-RC1, <= 4.17.7
4.17.8
craftcms/cms
>= 5.0.0-RC1, <= 5.9.13
5.9.14
Связанные уязвимости
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-privileged authenticated user can read private asset content by calling assets/edit-image with an arbitrary assetId that they are not authorized to view. The endpoint returns image bytes (or a preview redirect) without enforcing a per-asset view authorization check, leading to potential unauthorized disclosure of private files. This issue has been patched in versions 4.17.8 and 5.9.14.