CVE-2026-33161 Craft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users
Low-privileged users can access private asset editor metadata without proper authorization checks in Craft CMS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33161?
CVE-2026-33161 is a low-severity missing authorization vulnerability in Craftcms Craft Cms, published on 24 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-privileged authenticated user can call assets/image-editor with the ID of a private asset they cannot view and still receive editor response data, including focalPoint. The endpoint returns private editing metadata without per-asset authorization validation. This issue has been patched in versions 4.17.8 and 5.9.14.
Which versions are affected by CVE-2026-33161?
4 open source packages ship an affected version, including craftcms/cms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
craftcms/cms Packagist | From 4.0.0-RC1 | 4.17.8 |
craftcms/cms Packagist | From 4.0.0-RC1 | 4.17.8 |
craftcms/cms Packagist | From 5.0.0-RC1 | 5.9.14 |
craftcms/cms Packagist | From 5.0.0-RC1 | 5.9.14 |
Products include Craftcms Craft Cms.
How do I fix CVE-2026-33161?
Upgrade craftcms/cms to a fixed version for your release line: 4.17.8 or 5.9.14.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-33161 being exploited?
There is no known exploitation of CVE-2026-33161 in the wild and no public exploit code.
Other vulnerabilities in Craftcms Craft Cms
Sources
Also known as GHSA-vgjg-248p-rfm2.