Statamic CMS Asset Authorization Vulnerability Allowing Unauthorized Access to Asset Metadata

A vulnerability in Statamic CMS versions prior to 5.73.6 and 6.2.5 allows users without permission to view assets to download them and access their metadata. This issue does not affect logged-out users or those without control panel access.

Impact

Exploitation of this vulnerability allows unauthorized users to access and download assets they do not have permission to view, along with associated metadata.

Reproduction

To reproduce this vulnerability, a user must have a role that does not include permission to view assets. Once this is established, the user can request assets through the control panel, bypassing the intended authorization restrictions.

Remediation

Users can upgrade to Statamic CMS versions 5.73.6 or 6.2.5 to address this vulnerability.