CVE-2026-33158 Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)

What is CVE-2026-33158?

CVE-2026-33158 is a medium-severity missing authorization vulnerability in Craftcms Craft Cms, published on 24 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-privileged authenticated user can read private asset content by calling assets/edit-image with an arbitrary assetId that they are not authorized to view. The endpoint returns image bytes (or a preview redirect) without enforcing a per-asset view authorization check, leading to potential unauthorized disclosure of private files. This issue has been patched in versions 4.17.8 and 5.9.14.

Weakness: CWE-639

Which versions are affected by CVE-2026-33158?

4 open source packages ship an affected version, including craftcms/cms. It affects 1 product.

Products include Craftcms Craft Cms.

How do I fix CVE-2026-33158?

Upgrade craftcms/cms to a fixed version for your release line: 4.17.8 or 5.9.14.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-33158 being exploited?

There is no known exploitation of CVE-2026-33158 in the wild and no public exploit code.

Other vulnerabilities in Craftcms Craft Cms

• CVE-2025-32432 Craft CMS Code Injection Exploited Critical 10.0
• CVE-2024-56145 Craft CMS Code Injection Exploited Critical 9.3
• CVE-2025-23209 Craft CMS Code Injection Exploited High 8.1
• CVE-2025-35939 Craft CMS External Control of Assumed-Immutable Web Parameter Exploited Medium 6.9
• CVE-2023-41892 Craft CMS Remote Code Execution vulnerability Critical 10.0

All Craftcms Craft Cms vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3pvf-vxrv-hh9c.