Craft CMS Privilege Escalation Vulnerability in GraphQL API

A privilege escalation vulnerability has been identified in Craft CMS versions 4.0.0-RC1 prior to 4.17.0-beta.1 and 5.9.0-beta.1. This vulnerability exists within the GraphQL API, allowing an authenticated user with write access to one asset volume to escalate privileges and modify or transfer assets from any other volume, including restricted or private ones. The issue arises because the saveAsset GraphQL mutation checks authorization based on the volume but does not verify that the asset belongs to the authorized volume, enabling unauthorized cross-volume asset modifications and transfers.

Impact

Exploitation of this vulnerability could lead to unauthorized access and modification of assets across different volumes, bypassing restrictions and potentially transferring confidential assets from private to public volumes.

Remediation

Users can upgrade to Craft CMS versions 4.17.0-beta.1 or 5.9.0-beta.1 to address this vulnerability.