CVE-2026-33158

Craft CMS - CVE-2026-33158: A low-privileged authenticated user could read private asset content by calling assets/edit-image with an arbitrary assetId, bypassing per-asset view authorization. The endpoint returns image bytes or a preview redirect without enforcing access checks, enabling unautho...

EUVD-2026-14936

Craft CMS: Low-privilege users could read private asset contents when editing an asset IDOR...