Craft CMS may expose private assets through anonymous "generate transform" calls via transform URL

Summary

An unauthenticated user can call assets/generate-transform with a private assetId, receive a valid transform URL, and fetch transformed image bytes.

The endpoint is anonymous and does not enforce per-asset authorization before returning the transform URL.

Details

Root cause:

• Anonymous endpoint accepts user-controlled asset reference.
• It creates and returns a transform URL for that asset without checking access rights.
• If the transform output is reachable, guest users can read content derived from private assets.

Who is impacted:

• Installations where private source assets can be transformed and transform URLs are reachable.

Security consequence:

• Anonymous users can obtain content derived from private assets without authentication.

Resources

https://github.com/craftcms/cms/commit/7290d91639e