Why does GHSA-xj2c-g5xp-4p47 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-xj2c-g5xp-4p47?

GHSA-xj2c-g5xp-4p47 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-xj2c-g5xp-4p47?

GHSA-xj2c-g5xp-4p47 affects 1 product, including: composer/craftcms/cms:\u003e= 4.0.0-RC1, \u003c= 4.17.7.

⚠ Withdrawn by GitHub Security Advisories

Withdrawn: August 6, 2026

GHSA-xj2c-g5xp-4p47MediumCVSS 4.3Disclosed before NVD

Duplicate Advisory: Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission

Vendor

GitHub Security Advisories

Published

June 21, 2026

Last Modified

August 6, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-x76w-8c62-48mg. This link is maintained to preserve external references.

Original Description

Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user without permission to view a target private asset can call the endpoint with an attacker-controlled assetId and receive preview HTML containing a signed fallback transform preview link for that private asset, because no asset-view permission check is performed before preview generation. This affects versions >= 4.0.0-RC1, <= 4.17.7 and >= 5.0.0-RC1, <= 5.9.13, and is fixed in 4.17.8 and 5.9.14.

🎯 Affected products1

composer/craftcms/cms:>= 4.0.0-RC1, <= 4.17.7

📋 Description

Duplicate Advisory

Original Description

🎯 Affected products1

🔗 References (5)