Craft CMS: Low-privilege users could read private asset contents when editing an asset (IDOR)

Summary

A low-privileged authenticated user can read private asset content by calling assets/edit-image with an arbitrary assetId that they are not authorized to view.

The endpoint returns image bytes (or a preview redirect) without enforcing a per-asset view authorization check, leading to potential unauthorized disclosure of private files.

Details

Root cause:

• A user-controlled object reference (assetId) is used to load and return sensitive content.
• The action does not verify whether the current user is authorized to view that asset.
• This creates an authenticated IDOR / authorization bypass.

Impact

• Craft installations where private/non-public assets exist and low-privileged users can authenticate.

Resources

https://github.com/craftcms/cms/commit/7290d91639e