CVE-2026-33161
Craft CMS' anonymous "assets/image-editor" calls return private asset editor metadata to unauthorized users
描述
### Summary A low-privileged authenticated user can call `assets/image-editor` with the ID of a private asset they cannot view and still receive editor response data, including `focalPoint`. The endpoint returns private editing metadata without per-asset authorization validation. Root-cause analysis: 1. `actionImageEditor()` accepts `assetId` from the request body. 2. The asset is loaded, and the focal-point data is read. 3. Response returns `html` and `focalPoint`. 4. No explicit authorization check is applied before the response. ### Impact ## Affected deployments: * Craft sites where asset edit metadata should remain restricted to authorized users. ## Security consequence: * Unauthorized users can extract private editor metadata and related editor context for inaccessible assets.
如何修補 CVE-2026-33161
要修補 CVE-2026-33161,請將受影響套件升級到下列已修補版本。
- —升級至 5.9.14 或更新版本
CVE-2026-33161 正在被利用嗎?
低 — EPSS 為 0.0%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- >= 5.0.0-RC1, < 5.9.14
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U |