Craft CMS EUVD-2026-69914

Exploitation requires a valid, authenticated Craft CMS control panel account - unauthenticated access is not possible per the CVSS 4.0 PR:L metric. The attacker must be able to submit POST requests to the /assets/move-info endpoint on a Craft CMS 5.7.0-5.10.11 installation. The leaked data is strictly limited to volume-level metadata (asset count and total storage size in bytes), not file names, file contents, or user credentials. Exploitation is most consequential in multi-volume, multi-role deployments where volume-level isolation is relied upon to enforce business or regulatory data segregation. Single-volume or single-user installations derive little value from the disclosed metadata.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L) correctly characterizes this as a network-accessible, low-complexity authorization flaw requiring only a valid authenticated session - even a mid-sized municipal IT team in zabrze running Craft CMS in a multi-tenant configuration, where separate departments are scoped to distinct volumes, should treat this as a meaningful internal trust-boundary failure worth patching promptly. Real-world risk is moderate-to-low in absolute terms: the disclosed data is limited to aggregate volume metadata (asset count and total storage bytes) and does not include file names, file contents, or credentials, substantially constraining direct damage. The absence from CISA KEV and the lack of public exploit code align with an expectation of low widespread exploitation probability. The primary residual risk is reconnaissance value - an insider threat or compromised low-privilege account can silently map the existence and approximate scale of restricted volumes, informing a subsequent escalation attempt. EPSS score was not provided in the input data and cannot be independently stated.

An authenticated control panel user with a restricted editor role, scoped only to a subset of volumes, crafts a POST request to /assets/move-info supplying folderIds belonging to volumes outside their assigned permissions. The endpoint returns asset count and total storage size for each queried volume without performing a permission check, allowing the attacker to silently determine the existence and approximate scale of restricted asset repositories. No public exploit code exists, but the technique requires nothing beyond a standard authenticated HTTP session and knowledge of the endpoint path.