Craft CMS Unauthorized Asset Access Vulnerability

A vulnerability exists in Craft CMS versions 4.0.0-RC1 prior to 4.17.8 and 5.0.0-RC1 prior to 5.9.14, allowing low-privileged authenticated users to access private asset content. This is achieved by sending a request to the 'assets/edit-image' endpoint with an arbitrary 'assetId' that the user is not authorized to view. The endpoint responds with image data or a preview redirect, without applying the necessary authorization checks for each asset, potentially leading to unauthorized disclosure of private files.

Impact

Exploitation of this vulnerability could result in unauthorized access to private asset content, allowing low-privileged users to read sensitive files they should not have access to.

Remediation

Users can upgrade to Craft CMS version 4.17.8 or 5.9.14 to address this vulnerability.