SB2026032462 - Multiple vulnerabilities in Craft CMS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026032462

SB2026032462 - Multiple vulnerabilities in Craft CMS

Published: March 24, 2026

Security Bulletin ID SB2026032462
Severity
Medium
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 secuirty vulnerabilities.


1) Missing Authentication for Critical Function (CVE-ID: CVE-2026-33159)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to missing authentication for critical function. A remote attacker can execute project configuration sync operations.


2) Missing Authorization (CVE-ID: CVE-2026-33162)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to missing authorization in "entries/move-to-section". A remote user can move entries without section permissions.


3) Missing Authorization (CVE-ID: N/A)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to missing authorization within the assets/preview-file. A remote user without asset access can retrieve private preview metadata.


4) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-33160)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to authorization bypass through user-controlled key. A remote attacker can expose private assets via transform URL.


5) Information disclosure (CVE-ID: CVE-2026-33158)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the endpoint returns image bytes (or a preview redirect) without enforcing a per-asset view authorization check. A remote attacker can read private asset contents when editing an asset.


6) Missing Authorization (CVE-ID: CVE-2026-33161)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to missing authorization in "assets/image-editor". A remote user can extract private editor metadata and related editor context for inaccessible assets.


Remediation

Install update from vendor's website.

References