CVE-2026-33161: 
PHP vulnerability analysis and mitigation

CVE-2026-33161 is an information disclosure vulnerability in Craft CMS caused by missing authorization on the assets/image-editor endpoint. A low-privileged authenticated user can supply the ID of a private asset they are not permitted to view and still receive editor response data — including focalPoint metadata — because no per-asset authorization check is performed before the response is returned. Affected versions are Craft CMS 4.0.0-RC1 through 4.17.7 and 5.0.0-RC1 through 5.9.13. The vulnerability was published on March 24, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 1.3 (Low) (Github Advisory, Craft CMS Advisory).

The root cause is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and CWE-862 (Missing Authorization). The vulnerable function actionImageEditor() in src/controllers/AssetsController.php accepts an assetId parameter from the request body, loads the corresponding asset, reads its focal-point data, and returns an HTML response including focalPoint — all without performing any viewAssets or viewPeerAssets permission check on the requesting user. The fix, applied in commit d30df31, adds calls to $this->requireVolumePermissionByAsset('viewAssets', $asset) and $this->requirePeerVolumePermissionByAsset('viewPeerAssets', $asset) before the response is constructed (Craft CMS Advisory, Patch Commit).

Successful exploitation allows a low-privileged authenticated user to extract private asset editor metadata — specifically focalPoint data and related editor context — for assets they are not authorized to access. The impact is limited to confidentiality; there is no integrity or availability impact, and the vulnerability does not enable code execution, lateral movement, or privilege escalation. Affected deployments are Craft CMS sites where asset edit metadata is intended to be restricted to authorized users only (Github Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation at this time. The vulnerability requires a valid low-privileged account on the target Craft CMS instance, limiting the attacker pool. The EPSS score is approximately 0.039% (0.000390), placing it in the 13th percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Obtain a low-privileged account: Register or obtain credentials for any authenticated user account on the target Craft CMS instance (e.g., a contributor or editor role without asset view permissions).
2. Enumerate private asset IDs: Identify the numeric IDs of private assets the account cannot normally view. IDs may be guessable (sequential integers) or discoverable through other application features that leak asset references.
3. Craft the malicious request: Send an authenticated HTTP POST request to the assets/image-editor endpoint, supplying the target private asset's ID in the request body (e.g., assetId=<target_id>).
4. Receive unauthorized metadata: The server responds with editor HTML and focalPoint metadata for the private asset without performing an authorization check, disclosing restricted information to the attacker (Craft CMS Advisory).

• Network: Repeated or automated POST requests to the assets/image-editor endpoint from a single authenticated user session, particularly with varying assetId values that do not correspond to assets the user owns or has permission to view.
• Logs: Web server or Craft CMS application logs showing POST requests to /actions/assets/image-editor (or equivalent action URL) from low-privileged user accounts, especially with sequential or enumerated asset IDs.
• Behavior: A single user account making an unusually high volume of image-editor requests across a short time window, suggesting automated enumeration of asset IDs.

Craft CMS has released patched versions addressing this vulnerability: upgrade 4.x installations to 4.17.8 or later, and upgrade 5.x installations to 5.9.14 or later. No configuration-based workaround is documented; upgrading is the recommended and only confirmed remediation. As an interim measure, administrators can restrict access to the Craft CMS control panel to trusted networks or authenticated users with appropriate roles (Craft CMS Advisory, Release 4.17.8, Release 5.9.14).

The vulnerability was reported by security researcher Susen2 and published by the Craft CMS maintainer (angrybrad) via GitHub Security Advisories on March 24, 2026. The issue was rated low severity by the vendor, consistent with its limited confidentiality impact and authentication requirement. No significant broader media coverage or notable community debate has been observed beyond standard vulnerability database indexing (Craft CMS Advisory).