CVE-2026-33160: 
PHP vulnerability analysis and mitigation

CVE-2026-33160 is an authorization bypass vulnerability in Craft CMS that allows unauthenticated users to access private assets via the anonymous assets/generate-transform endpoint. The endpoint accepts a user-controlled assetId parameter without enforcing per-asset authorization checks, enabling guest users to receive valid transform URLs and fetch transformed image bytes from private assets. It affects Craft CMS versions 4.0.0-RC1 through 4.17.7 and 5.0.0-RC1 through 5.9.13. The vulnerability was disclosed on March 24, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is a missing authorization check (CWE-862) combined with an authorization bypass through a user-controlled key (CWE-639) in the actionGenerateTransform method of src/controllers/AssetsController.php. The endpoint is configured as anonymous, meaning it does not require authentication; an attacker can supply any assetId value in the request body, and the controller will generate and return a valid transform URL for that asset without verifying whether the caller has access rights to it. The fix, applied in commit 7290d91639e, adds a $this->requirePermission('accessCp') call before the assetId parameter is read, restricting the endpoint to authenticated Control Panel users (GitHub Advisory, Patch Commit).

Successful exploitation allows unauthenticated attackers to bypass access controls and retrieve transformed image content derived from private assets that should be restricted to authorized users. The confidentiality impact is limited to image data (transformed representations of private assets), with no integrity or availability impact. Attackers could enumerate sequential or guessable assetId values to systematically extract private visual content without any credentials (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.047%, reflecting a low probability of exploitation in the near term. The attack requires no authentication, no user interaction, and low complexity, making it trivially exploitable if an attacker can identify valid private assetId values on a reachable instance.

1. Reconnaissance: Identify Craft CMS installations running versions 4.0.0-RC1 through 4.17.7 or 5.0.0-RC1 through 5.9.13 using passive techniques (e.g., HTTP response headers, generator meta tags, or Shodan/Censys searches for Craft CMS fingerprints).
2. Enumerate asset IDs: Craft CMS typically uses sequential integer asset IDs. An attacker can iterate over a range of integer values (e.g., 1 through N) as candidate assetId values.
3. Send unauthenticated request: Issue an HTTP POST request to the /actions/assets/generate-transform endpoint with a body containing assetId=<target_id> and a valid handle parameter (e.g., a known transform handle or a guessed one).
4. Receive transform URL: If the asset exists and a transform can be generated, the server returns a valid transform URL without checking whether the caller is authorized to access that asset.
5. Fetch transformed image: Use the returned URL to download the transformed image bytes, effectively reading content derived from a private asset without authentication (GitHub Advisory, Patch Commit).

• Network: Repeated unauthenticated HTTP POST requests to /actions/assets/generate-transform (or equivalent action URL) from external IP addresses, particularly with sequentially incrementing assetId values in the request body.
• Logs: Web server access logs showing POST requests to the generate-transform endpoint from unauthenticated sessions (no session cookie or guest session), especially in high volume or rapid succession.
• Logs: Application logs showing transform generation activity for assets that are not associated with any authenticated user session.
• Network: Subsequent GET requests to transform URLs (e.g., paths under the configured transforms directory) from the same IP address shortly after the POST requests, indicating successful retrieval of transformed image content.

Craft CMS has released patched versions 4.17.8 (for the 4.x branch) and 5.9.14 (for the 5.x branch) that enforce a requirePermission('accessCp') check on the assets/generate-transform endpoint before processing the assetId parameter (4.17.8 Release, 5.9.14 Release). Upgrading to one of these versions is the recommended remediation. If immediate patching is not possible, a network-level workaround is to restrict access to the /actions/assets/generate-transform endpoint to authenticated users only via a web application firewall or reverse proxy rule that blocks unauthenticated POST requests to that path.