PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-56384 craftcms CVE debrief

CVE-2026-56384 is a missing authorization vulnerability in Craft CMS, affecting versions 4.0.0-RC1 to 4.17.7 and 5.0.0-RC1 to 5.9.13. This vulnerability allows a Control Panel user without permission to view a target private asset to call the assets/preview-thumb endpoint with an attacker-controlled assetId and receive preview HTML containing a signed fallback transform preview link for that private asset. The vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. To address this vulnerability, defenders should prioritize patching to version 4.17.8 or 5.9.14.

Vendor
craftcms
Product
cms
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-21
Original CVE updated
2026-06-24
Advisory published
2026-06-21
Advisory updated
2026-06-24

Who should care

Defenders responsible for Craft CMS installations, particularly those with Control Panel users who have access to private assets, should be aware of this vulnerability. Additionally, security teams and administrators managing Craft CMS should prioritize patching to mitigate potential exposure.

Technical summary

The vulnerability exists in the assets/preview-thumb endpoint of Craft CMS, where no asset-view permission check is performed before preview generation. This allows an attacker to bypass authorization and access preview HTML for private assets by providing a controlled assetId. The issue affects multiple versions of Craft CMS, including 4.0.0-RC1 to 4.17.7 and 5.0.0-RC1 to 5.9.13, and is fixed in versions 4.17.8 and 5.9.14.

Defensive priority

Medium priority due to CVSS score of 5.3 and potential for unauthorized access to private asset previews.

Recommended defensive actions

  • Apply patches to version 4.17.8 or 5.9.14
  • Review and restrict access to the assets/preview-thumb endpoint
  • Monitor for suspicious activity related to asset previews
  • Inventory Craft CMS installations and versions
  • Verify official advisories for additional guidance

Evidence notes

The vulnerability is confirmed by the CVE record and NVD detail. Primary evidence includes the CVE description, CVSS vector, and references to source code changes and security advisories. Affected product versions are 4.0.0-RC1 to 4.17.7 and 5.0.0-RC1 to 5.9.13. Defenders should verify Craft CMS versions and apply patches to mitigate exposure.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-56384 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-56384

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-56384 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-56384

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.