EUVD-2026-14942

Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users...

Authorization Bypass Through User-Controlled Key

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the assets/edit-image endpoint when processing the assetId parameter. An attacker can access unauthorized private asset contents by supplyi...