CVE-2026-25497: 
PHP vulnerability analysis and mitigation

CVE-2026-25497 is a privilege escalation vulnerability in Craft CMS's GraphQL API, classified as "GraphQL Asset Mutation Privilege Escalation." It affects Craft CMS versions 4.0.0-RC1 through before 4.17.0-beta.1 and 5.0.0-RC1 through before 5.9.0-beta.1. The vulnerability was disclosed on February 9, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.6 (High) (GitHub Advisory, Craft CMS Advisory).

The root cause is an authorization bypass through a user-controlled key (CWE-639) combined with improper privilege management (CWE-269), located in src/gql/resolvers/mutations/Asset.php (lines 57–107). The saveAsset GraphQL mutation validates the caller's authorization against the schema-resolved volume (i.e., the volume the user has write access to), but then fetches the target asset by its ID without verifying that the fetched asset actually belongs to that authorized volume. This IDOR-style flaw allows an attacker to supply an asset ID from any other volume — including restricted or private ones — and perform unauthorized modifications or transfers. The fix, introduced in commit ac7edf8, adds a check that compares the fetched asset's volumeId against the authorized volume's ID and re-validates schema permissions if they differ (GitHub Commit, GitHub Advisory).

An authenticated attacker with write access to even a single asset volume can exploit this vulnerability to access, modify metadata of, or transfer assets belonging to any other volume in the Craft CMS instance — including volumes explicitly marked as restricted or private. This compromises both the confidentiality and integrity of sensitive assets system-wide, and can enable data exfiltration by moving private assets to publicly accessible volumes. In shared or multi-tenant hosting environments, this also breaks tenant isolation, potentially exposing one customer's assets to another (GitHub Advisory, Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires only low privileges (an authenticated user account with write access to at least one asset volume) and no user interaction, making it relatively straightforward to exploit if credentials are obtained. The EPSS score is approximately 0.012% (6th percentile), indicating a currently low probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability was reported by researcher vitalysim (GitHub Advisory).

1. Obtain credentials: Acquire valid Craft CMS user credentials with write access to at least one asset volume (e.g., via phishing, credential stuffing, or a free/trial account on a shared instance).
2. Identify target volumes: Use the Craft CMS GraphQL API to enumerate available volumes and discover asset IDs belonging to restricted or private volumes (e.g., via volumes or assets queries if partially accessible).
3. Craft malicious mutation: Construct a saveAsset GraphQL mutation that references an asset ID belonging to a restricted volume while authenticating with a schema token that only grants access to a different, permitted volume.
4. Submit the mutation: Send the crafted GraphQL request to the Craft CMS GraphQL endpoint (typically /api or a custom endpoint), supplying the out-of-scope asset ID in the mutation arguments.
5. Achieve unauthorized access: Because the server validates authorization against the schema-resolved volume but fetches the asset by ID without cross-checking volume ownership, the mutation succeeds — allowing the attacker to modify asset metadata or transfer the asset to a public volume for exfiltration (GitHub Advisory, GitHub Commit).

• Network: Unusual GraphQL POST requests to the Craft CMS API endpoint containing saveAsset mutations with asset IDs that do not belong to the volume specified in the schema token; requests originating from unexpected IP addresses or user agents.
• Logs: Craft CMS application logs showing saveAsset mutations executed by users against asset IDs outside their authorized volume scope; repeated GraphQL API calls from a single authenticated user targeting multiple asset IDs in rapid succession.
• File System / Asset Storage: Assets appearing in public or unexpected volumes that were previously stored in private/restricted volumes; unexpected changes to asset metadata (titles, filenames, folder paths) in restricted volumes.
• Application Audit Trail: Craft CMS audit log entries showing asset save/transfer events attributed to users who should not have access to the affected volumes.

Craft CMS has released patched versions: 4.17.0-beta.1 (for the 4.x branch) and 5.9.0-beta.1 (for the 5.x branch); the fix is also included in the stable release 5.8.22 (Craft CMS Release, GitHub Advisory). Upgrading to a patched version is the recommended remediation. If an immediate upgrade is not possible, restrict GraphQL API access to trusted, authenticated users only and implement network-level controls (e.g., firewall rules or WAF policies) to limit exposure of the GraphQL endpoint. Additionally, audit existing asset access logs for any unauthorized cross-volume modifications or transfers that may have already occurred.