Is there a patch available for CVE-2026-56384?

Yes, a patch is available for CVE-2026-56384. Update the affected software to the latest version immediately.

Craft CMS CVE-2026-56384

Q: What is the CVSS score of CVE-2026-56384?

CVE-2026-56384 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

Q: Which versions of Craft CMS are affected by CVE-2026-56384?

Missing authorization in the Craft CMS `assets/preview-thumb` Control Panel endpoint allows any authenticated low-privilege CP user to obtain signed transform preview URLs for private assets they are…. A patch is available.

EUVD-2026-38178 MEDIUM

Missing Authorization (CWE-862)

2026-06-21 VulnCheck

GHSA-xj2c-g5xp-4p47

Authentication Bypass Cms Craftcms

5.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-reachable endpoint requires authenticated CP session (PR:L); impact is limited confidentiality disclosure of signed URLs (C:L), with no integrity or availability consequences.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 22, 2026 - 06:37 vuln.today

Analysis Generated

Jun 22, 2026 - 06:37 vuln.today

DescriptionCVE.org

Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user without permission to view a target private asset can call the endpoint with an attacker-controlled assetId and receive preview HTML containing a signed fallback transform preview link for that private asset, because no asset-view permission check is performed before preview generation. This affects versions >= 4.0.0-RC1, <= 4.17.7 and >= 5.0.0-RC1, <= 5.9.13, and is fixed in 4.17.8 and 5.9.14.

AnalysisAI

Missing authorization in the Craft CMS assets/preview-thumb Control Panel endpoint allows any authenticated low-privilege CP user to obtain signed transform preview URLs for private assets they are not permitted to view, by supplying an attacker-controlled assetId. Affected installations span the 4.x branch (4.0.0-RC1 through 4.17.7) and 5.x branch (5.0.0-RC1 through 5.9.13); patches are available in 4.17.8 and 5.9.14. No public exploit or active exploitation has been identified at time of analysis.

Technical ContextAI

Craft CMS (CPE: cpe:2.3:a:craftcms:cms) is a PHP-based CMS whose Control Panel includes an assets/preview-thumb endpoint implemented in AssetsController.php. The endpoint generates preview HTML - including signed fallback transform preview URLs - for requested asset IDs. The root cause is CWE-862 (Missing Authorization): before this fix, the endpoint accepted any authenticated CP session and returned preview content without verifying that the requesting user held viewAssets permission on the target volume or viewPeerAssets permission for peer-owned assets. The patch (commit d30df3112220db1ffd6726a3ed11857014c7fb27) inserts two explicit permission gate calls - requireVolumePermissionByAsset('viewAssets', $asset) and requirePeerVolumePermissionByAsset('viewPeerAssets', $asset) - directly into the preview generation flow, enforcing the authorization boundary that was entirely absent.

RemediationAI

Upgrade to Craft CMS 4.17.8 (for 4.x installations) or 5.9.14 (for 5.x installations); these are the vendor-released patched versions confirmed by the GitHub advisory (GHSA-x76w-8c62-48mg) and the patch commit at https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27. If immediate upgrade is not possible and the deployment hosts private assets that must remain access-controlled, restrict Control Panel access to the minimum set of trusted users as a temporary compensating control - this reduces the attack surface but does not eliminate the vulnerability. There is no known configuration-level toggle to disable the assets/preview-thumb endpoint without disrupting legitimate CP preview functionality. Blocking the endpoint at a WAF or reverse proxy layer is technically feasible but will break asset preview UX for all CP users.