CVE-2026-33158: 
PHP vulnerability analysis and mitigation

CVE-2026-33158 is an Insecure Direct Object Reference (IDOR) / authorization bypass vulnerability in Craft CMS that allows low-privileged authenticated users to read private asset content without proper authorization. It affects Craft CMS versions 4.0.0-RC1 through 4.17.7 and 5.0.0-RC1 through 5.9.13. The vulnerability was published on March 24, 2026, and patches were released the same day. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 4.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key): the assets/edit-image endpoint accepts a user-supplied assetId parameter and uses it to load and return asset content (image bytes or a preview redirect) without performing a per-asset view authorization check to verify whether the requesting user is permitted to access that specific asset. This creates a classic authenticated IDOR condition where any low-privileged user who can authenticate to the CMS can enumerate or directly supply arbitrary asset IDs to retrieve private files. The fix, visible in commit 7290d91, adds a requirePermission('accessCp') check and enforces proper per-asset authorization before serving content (GitHub Advisory, Patch Commit).

Successful exploitation results in unauthorized disclosure of private or restricted asset files (images and other media) stored within Craft CMS. The confidentiality impact is rated High, as any authenticated low-privileged user can access assets intended for restricted audiences. There is no integrity or availability impact — the vulnerability does not allow modification of data or disruption of service. Affected installations are those where private/non-public assets exist and where low-privileged user accounts are provisioned (GitHub Advisory).

No public proof-of-concept exploit code has been reported, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.013–0.016% (4th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid low-privileged authenticated account, which limits the attack surface compared to unauthenticated vulnerabilities.

1. Obtain low-privileged credentials: Acquire any valid authenticated account on the target Craft CMS installation (e.g., a contributor, editor, or other low-privilege role).
2. Authenticate to the CMS: Log in to the Craft CMS control panel using the obtained credentials to establish a valid session.
3. Identify the vulnerable endpoint: Locate the assets/edit-image action endpoint, typically accessible at a URL such as /index.php?p=admin/actions/assets/edit-image or equivalent based on the site's CP trigger.
4. Enumerate asset IDs: Craft HTTP requests to the endpoint with sequentially or randomly guessed assetId values (integer IDs) that the attacker's account is not authorized to view.
5. Retrieve private asset content: For each valid assetId, the endpoint returns the image bytes directly or issues a preview redirect to the asset URL — exposing private file content without any authorization check (GitHub Advisory, Patch Commit).

• Network: Repeated HTTP requests to the assets/edit-image action endpoint (e.g., /actions/assets/edit-image) with varying assetId parameter values from a single authenticated session, particularly for IDs outside the user's normal scope.
• Logs: Web server or Craft CMS access logs showing sequential or high-volume requests to the assets/edit-image endpoint from a single user account; HTTP 200 responses to asset requests for IDs that the user should not have access to.
• Behavioral: A low-privileged user account generating an unusually high number of asset retrieval requests in a short time window, especially across asset IDs that span multiple volumes or restricted sections.

Craft CMS has released patched versions addressing this vulnerability: 4.17.8 for the 4.x branch and 5.9.14 for the 5.x branch. Administrators should upgrade immediately to one of these versions. As an interim measure, review and restrict which users have authenticated access to the Craft CMS control panel, and audit access logs for suspicious assets/edit-image endpoint activity. No configuration-only workaround is available that fully mitigates the vulnerability without upgrading (Craft CMS 4.17.8 Release, Craft CMS 5.9.14 Release).