Improper access control in Craft CMS - CVE-2026-55792
Published: June 16, 2026
Vulnerability identifier: #VU134677
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-55792
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the system email template rendering functionality when rendering sandboxed system message templates containing the dataUrl() Twig function. A remote user can embed a file-reading payload into a system email template to disclose sensitive information.
Exploitation requires the utility:system-messages permission and configured email sending. The issue can expose the .env file contents, including secrets that may enable subsequent admin account takeover.
Affected software
Craft CMS
How to mitigate CVE-2026-55792
Install security update from vendor's website.
Craft CMS - addressed in versions 4.18.0, 5.10.0