What is GHSA-f4h3-qhg5-j6mq?

GHSA-f4h3-qhg5-j6mq is a security advisory published by GitHub Security Advisories with Medium severity. Duplicate Advisory: Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata

Why does GHSA-f4h3-qhg5-j6mq have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-f4h3-qhg5-j6mq?

GHSA-f4h3-qhg5-j6mq has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-f4h3-qhg5-j6mq?

GHSA-f4h3-qhg5-j6mq affects 1 product, including: composer/craftcms/cms:\u003e= 5.0.0-RC1, \u003c= 5.9.13.

⚠ Withdrawn by GitHub Security Advisories

Withdrawn: August 6, 2026

GHSA-f4h3-qhg5-j6mqMediumCVSS 4.3Disclosed before NVD

Duplicate Advisory: Craft CMS: Authorized asset "preview file" requests bypass allows users without asset access to retrieve private preview metadata

Vendor

GitHub Security Advisories

Published

June 21, 2026

Last Modified

August 6, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-44px-qjjc-xrhq. This link is maintained to preserve external references.

Original Description

Craft CMS versions >= 5.0.0-RC1, <= 5.9.13 and >= 4.0.0-RC1, <= 4.17.7 contain an authorization bypass in the assets/preview-file endpoint. The action does not enforce per-asset view authorization before returning preview content, allowing an authenticated low-privileged user to supply a controlled assetId for an asset they are not permitted to view and still receive preview response data (previewHtml), including a private preview image route containing the target private assetId. Fixed in 5.9.14 and 4.17.8.

🎯 Affected products1

composer/craftcms/cms:>= 5.0.0-RC1, <= 5.9.13

📋 Description

Duplicate Advisory

Original Description

🎯 Affected products1

🔗 References (5)