Craft CMS EUVD-2026-38178

Exploitation requires an active, authenticated Craft CMS Control Panel session - the endpoint is not reachable by unauthenticated users, as CP login is enforced upstream. The attacker must supply valid assetId values belonging to private assets; without knowledge of or ability to enumerate valid IDs, exploitation is limited. The vulnerability is only materially impactful in deployments where CP users are granted differentiated asset permissions - specifically, where some users are intentionally restricted from viewing assets in certain volumes or from viewing peer-owned assets. Deployments where all CP users hold equivalent full-access permissions, or where no private volumes are configured, are not meaningfully affected. The impact is limited to confidentiality (signed preview URL disclosure); no write or destructive capability is exposed.

The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3, appropriately reflecting network reachability, low complexity, low-privilege requirement, and limited confidentiality impact. Real-world risk is further bounded by the requirement for an existing, authenticated Control Panel account - unauthenticated actors cannot reach this endpoint. The confidentiality impact is constrained to signed preview URLs rather than direct asset file delivery, though the practical exposure depends on whether those signed URLs grant access to the underlying asset binary. EPSS data was not provided in the source intelligence, preventing probabilistic exploitation comparison. The flaw is absent from CISA KEV and no POC has been identified; the vendor's own CHANGELOG entry labels it 'low-severity.' The authorization bypass is most material in multi-user Craft deployments where CP users are intentionally siloed from specific private volumes - environments with uniform CP permissions or no private volumes face negligible marginal risk from this CVE specifically.

An attacker with a low-privilege Craft CMS Control Panel account (e.g., a contributor role restricted from a private media volume) iterates over candidate integer assetId values by sending requests to the assets/preview-thumb endpoint. For each private asset the server resolves, the response includes preview HTML containing a signed fallback transform URL, which the attacker can then use to retrieve or redistribute the private asset. No public POC has been identified at time of analysis.