CVE-2026-33158 — Authorization Bypass Through User-Controlled Key in Craft CMS
Severity
4.9MEDIUMNVD
EPSS
0.0%
top 98.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 24
Description
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-privileged authenticated user can read private asset content by calling assets/edit-image with an arbitrary assetId that they are not authorized to view. The endpoint returns image bytes (or a preview redirect) without enforcing a per-asset view authorization check, leading to potential unauthorized disclosure of private files. This issue has …
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected Packages3 packages
Patches
🔴Vulnerability Details
3OSV▶
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)↗2026-03-24
GHSA▶
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)↗2026-03-24
CVEList▶
Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)↗2026-03-24