CVE-2026-124431 Craft CMS 5.10.0 before 5.11.2 Unauthorized Volume Browsing via Asset Replacement

Craft CMS from 5.10.0 before 5.11.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to browse volumes they lack permissions for. Attackers can delete a linked asset and use the replacement volume browser modal to view directory structures of all...

CVE-2026-124431 Craft CMS 5.10.0 before 5.11.2 Unauthorized Volume Browsing via Asset Replacement

Craft CMS from 5.10.0 before 5.11.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to browse volumes they lack permissions for. Attackers can delete a linked asset and use the replacement volume browser modal to view directory structures of all...

CVE-2026-124431 Craft CMS 5.10.0 before 5.11.2 Unauthorized Volume Browsing via Asset Replacement

Craft CMS from 5.10.0 before 5.11.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to browse volumes they lack permissions for. Attackers can delete a linked asset and use the replacement volume browser modal to view directory structures of all...

CVE-2026-124431

Craft CMS versions 5.10.0 through 5.11.2 are vulnerable to an authorization bypass (CWE-862) that allows authenticated low-privileged users to browse volumes they are not permitted to access. An attacker can delete a linked asset and leverage the replacement volume browser modal to view the direc...