Description
Craft CMS from 5.10.0 before 5.11.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to browse volumes they lack permissions for. Attackers can delete a linked asset and use the replacement volume browser modal to view directory structures of all volumes, though not file contents.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| craftcms | cms | 5.10.0 – < 5.11.2 | 5.11.2 |
References
- GitHub Security Advisory (GHSA-hvp5-pwxx-2752) vendor-advisory
- VulnCheck Advisory: Craft CMS 5.10.0 before 5.11.2 Unauthorized Volume Browsing via Asset Replacement third-party-advisory