5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-x76w-8c62-48mg

GHSA-x76w-8c62-48mg: Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission

Summary

A user with Control Panel access but without permission to view a target private asset can call assets/preview-thumb and receive preview HTML that contains a signed fallback transform link for that private asset.

Details

Root-cause analysis:

The endpoint accepts an attacker-controlled assetId.
Asset is resolved, and thumbnail HTML is returned.
No explicit asset-view permission check is performed before preview generation.

Impact

Type:

Missing authorization
Unauthorized preview-link disclosure

Affected deployments:

Craft sites with control panel users who have partial permissions and private assets.

Security consequence:

A control panel user without asset-view permission can still obtain signed preview transform link data for private assets.
This may increase private asset exposure risk depending on deployment and endpoint chaining.

Resources

https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-x76w-8c62-48mg

GHSA-x76w-8c62-48mg:

5.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/cms	composer	>= 4.0.0-RC1, <= 4.17.7	4.17.8
craftcms/cms	composer	>= 5.0.0-RC1, <= 5.9.13	5.9.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic case of missing authorization, where a sensitive operation lacks the necessary permission checks. In this instance, the actionPreviewFile function in craftcms\cms\controllers\AssetsController was responsible for generating asset previews. However, it failed to verify whether the user making the request had the rights to view the specific asset. This oversight could be exploited by a low-privileged authenticated user to gain information about private assets they should not have access to. The provided patch rectifies this by adding explicit permission checks at the beginning of the function, ensuring that only authorized users can generate asset previews. The identified vulnerable function, actionPreviewFile, is the central point where the security control was missing and subsequently added.

Vulnerable functions

craftcms\cms\controllers\AssetsController::actionPreviewFile

src/controllers/AssetsController.php

The vulnerability lies in the `actionPreviewFile` function, which, prior to the patch, did not perform any authorization checks to verify if the user had the necessary permissions to view the requested asset. The patch introduces calls to `requireVolumePermissionByAsset` and `requirePeerVolumePermissionByAsset` to enforce these checks, thus mitigating the vulnerability. The lack of these checks allowed unauthorized users to obtain preview information for private assets.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.