MEDIUM
Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController
Published Sep 2, 2026
5.3
MEDIUMCVSS 4.0
EPSS 0.28%
Description
Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to retrieve asset count and total storage size for volumes they cannot access.
Affected products
-
- Version 5.7.0StatusaffectedConstraints<5.10.12
- Version 5.10.12StatusunaffectedConstraints-
- Version
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (2)
- https://github.com/craftcms/cms/security/advisories/GHSA-5mjc-jqcw-6vrp exploitvendor-advisory
- https://www.vulncheck.com/advisories/craft-cms-5.7.0-before-5.10.12-information-disclosure-via-assetscontroller third-party-advisory
| Link | Providers | Tags |
|---|---|---|
| https://github.com/craftcms/cms/security/advisories/GHSA-5mjc-jqcw-6vrp | exploitvendor-advisory | |
| https://www.vulncheck.com/advisories/craft-cms-5.7.0-before-5.10.12-information-disclosure-via-assetscontroller | third-party-advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulnCheck
Published Sep 2, 2026
Updated Sep 2, 2026
Reserved Sep 2, 2026
Link CVE-2026-84802
CISA Vulnrichment
Updated Sep 2, 2026