Missing Authorization in Craft CMS - #VU159611
Published: November 6, 2026
Vulnerability identifier: #VU159611
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated user to view directory structures in Craft CMS volumes they are not authorized to access.
The vulnerability exists due to missing authorization checks in the asset replacement volume browser when deleting a linked asset prompts replacement selection. An authenticated user with access to one volume can attempt to delete an entry-linked asset in that volume and browse all volumes' directory structures, but cannot see files.
Affected software
Craft CMS
Remediation
Install security update from vendor's website.
Craft CMS - update to 5.11.2