Which versions of Craft CMS are affected by CVE-2026-44012?

Craft CMS 5.x contains an authentication bypass in asset management that allows authenticated control-panel users to enumerate sensitive folder structures and filenames across all volumes, regardless…. A patch is available.

How to fix or mitigate CVE-2026-44012?

Within 24 hours: Inventory all Craft CMS 5.x installations and document current versions. Within 7 days: Apply vendor-released patch to version 5.9.18 or later on all affected instances; verify via admin panel version check. Within 30 days: Conduct audit of asset folder access logs (if available) for the past 30 days to detect enumeration activity; review and reinforce volume-level permission assignments (viewAssets, viewPeerAssets) post-patch.

Craft CMS CVE-2026-44012

Q: What is the CVSS score of CVE-2026-44012?

CVE-2026-44012 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

HIGH

Missing Authorization (CWE-862)

2026-05-06 https://github.com/craftcms/cms

GHSA-33m5-hqp9-97pw

Authentication Bypass PHP

7.1

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 12, 2026 - 21:22 vuln.today

cvss_changed

CVSS changed

May 12, 2026 - 21:22 NVD

7.1 (HIGH)

Source Code Evidence Fetched

May 06, 2026 - 18:31 vuln.today

Analysis Generated

May 06, 2026 - 18:31 vuln.today

DescriptionGitHub Advisory

Summary

AssetsController::actionShowInFolder() fetches an asset by ID and returns its filename and complete folder hierarchy (including volume handle, volume UID, folder names, folder UIDs, and folder URI paths) without checking whether the requesting user has viewAssets or viewPeerAssets permission on the asset’s volume. Any authenticated CP user - even one with zero volume permissions - can enumerate asset filenames and the full folder structure of any volume by supplying arbitrary asset IDs.

This follows the exact same incomplete-patch pattern as four GHSAs merged on 2026-02-25 (GHSA-x76w-8c62-48mg, GHSA-vgjg-248p-rfm2, GHSA-5pgf-h923-m958, GHSA-3pvf-vxrv-hh9c), all of which added requireVolumePermissionByAsset() + requirePeerVolumePermissionByAsset() to sibling AssetsController actions. The actionShowInFolder method was introduced thirteen days before the patch wave and was not included in it.

Details

The vulnerability is in src/controllers/AssetsController.php at line 1437. The method:

Calls requireCpRequest() - verifies the request targets the CP, enforces accessCp permission via Controller::_enforceAllowAnonymous(), but does NOT enforce any volume-level permission.
Fetches any asset by ID with Asset::findOne($assetId) - no editable/savable scope filter, so all assets across all volumes are reachable.
Returns sensitive structural data via JSON.

Impact

Any authenticated control panel user with only accessCp permission can discover the filenames and complete folder structure (names, UIDs, handles, URIs) of assets in volumes they are not authorized to access.
Sensitive volume structures - private document repositories, confidential media, internal file names - are exposed to any user who can log into the control panel.
This enables targeted follow-up attacks: an attacker who knows a private asset’s filename and folder path may have other avenues to exfiltrate the actual file.

Resources

https://github.com/craftcms/cms/commit/e3f3eaab3d85badd713cfc2c24e5f0792ecdb586

AnalysisAI

Authenticated control-panel users in Craft CMS 5.x can enumerate asset filenames and complete folder hierarchies (volume handles, UIDs, folder names, URIs) across all volumes by sending arbitrary asset IDs to the AssetsController::actionShowInFolder endpoint, bypassing volume-level viewAssets and viewPeerAssets permission checks. The flaw stems from an incomplete February 2026 patch wave that fixed four sibling endpoints but missed this method, introduced 13 days before the patch release. No public exploit identified at time of analysis; vendor-released patch fixes 5.9.18 and later. This information disclosure vulnerability enables reconnaissance for follow-up attacks against restricted asset volumes.

Technical ContextAI

Craft CMS's AssetsController provides REST-style endpoints for asset management in the Control Panel. The actionShowInFolder method at src/controllers/AssetsController.php:1437 performs asset retrieval using Asset::findOne($assetId) without applying editable or savable query scopes that filter by user permissions. While the method calls requireCpRequest() to enforce accessCp permission (the base right to access the Control Panel interface), it omits the two volume-permission checks added to parallel endpoints in commit e3f3eaab during the February 25 patch wave: requireVolumePermissionByAsset('viewAssets') and requirePeerVolumePermissionByAsset('viewPeerAssets'). These methods verify that the requesting user holds explicit view permissions on the asset's parent volume. The missing check exemplifies CWE-862 (Missing Authorization) - the endpoint authenticates the user but fails to authorize access to the resource. Craft's permission model separates Control Panel access from volume-level grants; users may have accessCp but zero volume permissions, creating a privilege boundary this vulnerability crosses. The flaw is compositionally identical to GHSA-x76w-8c62-48mg, GHSA-vgjg-248p-rfm2, GHSA-5pgf-h923-m958, and GHSA-3pvf-vxrv-hh9c, all of which were patched in the same commit but targeted sibling controller methods.

RemediationAI

Upgrade to Craft CMS 5.9.18 or later, which adds the missing requireVolumePermissionByAsset and requirePeerVolumePermissionByAsset checks to AssetsController::actionShowInFolder per commit e3f3eaab3d85badd713cfc2c24e5f0792ecdb586. Composer users should run composer update craftcms/cms and deploy the updated vendor directory. Review the GitHub advisory at https://github.com/craftcms/cms/security/advisories/GHSA-33m5-hqp9-97pw for any additional vendor guidance. If immediate upgrade is not feasible, apply defense-in-depth compensating controls: restrict Control Panel access to trusted users only (review and revoke accessCp permission for any non-essential accounts), enable IP allowlisting for the /admin path if Craft configuration supports it (limits CP access to known networks, reducing insider threat surface but breaks remote administration), and audit recent CP access logs for anomalous asset enumeration patterns (rapid sequential requests to assets/show-in-folder with incrementing IDs). Note that IP restrictions may disrupt legitimate remote work; assess operational trade-offs. No workaround fully mitigates the flaw without patching.