8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25497

CVE-2026-25497: Craft has a GraphQL Asset Mutation Privilege Escalation

Craft is a platform for creating digital experiences. In Craft versions from 4.0.0-RC1 to before 4.17.0-beta.1 and 5.9.0-beta.1, there is a Privilege Escalation vulnerability in Craft CMS’s GraphQL API that allows an authenticated user with write access to one asset volume to escalate their privileges and modify/transfer assets belonging to any other volume, including restricted or private volumes to which they should not have access. The saveAsset GraphQL mutation validates authorization against the schema-resolved volume but fetches the target asset by ID without verifying that the asset belongs to the authorized volume. This allows unauthorized cross-volume asset modification and transfer. This vulnerability is fixed in 4.17.0-beta.1 and 5.9.0-beta.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25497

CVE-2026-25497:

8.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/cms	composer	>= 5.0.0-RC1, < 5.9.0-beta.1	5.9.0-beta.1
craftcms/cms	composer	>= 4.0.0-RC1, < 4.17.0-beta.1	4.17.0-beta.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the saveAsset function within the src/gql/resolvers/mutations/Asset.php file. The provided patch ac7edf868c1a81fd9c4dc49d3b3edf1cce113409 clearly shows the fix. The root cause of the privilege escalation is a missing authorization check. The saveAsset function is responsible for handling asset mutations via the GraphQL API. Before the patch, the function would fetch an asset using the ID from the mutation's arguments ($arguments['id']) but would only validate the user's permissions against the volume resolved from the GraphQL schema context ($volume). It failed to check if the fetched asset actually belonged to that authorized volume. This oversight allowed an authenticated user with write access to a single asset volume to craft a GraphQL mutation that specified a volume they had access to, but contained the ID of an asset in a different, restricted volume. The system would then incorrectly apply the mutation to the asset in the restricted volume. The patch rectifies this by adding a crucial check: if ($asset->volumeId !== $volume->id). This condition verifies if the asset's actual volume matches the one the user is authorized for. If they don't match, it triggers an additional authorization check (requireSchemaAction) for the asset's true volume, effectively closing the security hole.

Vulnerable functions

craft\gql\resolvers\mutations\Asset::saveAsset

src/gql/resolvers/mutations/Asset.php

The `saveAsset` function was vulnerable to privilege escalation because it did not verify that the asset being modified belonged to the volume the user was authorized to access. The function would fetch an asset based on the user-provided 'id' but would only perform authorization checks against the volume resolved from the GraphQL schema. This allowed an attacker with write permissions to one volume to modify or transfer an asset from any other volume by simply knowing its ID. The patch introduces a check to ensure that if the asset's volume does not match the authorized volume, an additional permission check is performed on the asset's actual volume.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.