CVE-2026-124431
Received Received - Intake

Authorization Bypass in Craft CMS Allows Volume Access

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
Craft CMS from 5.10.0 before 5.11.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to browse volumes they lack permissions for. Attackers can delete a linked asset and use the replacement volume browser modal to view directory structures of all volumes, though not file contents.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124431
EUVD
EUVD-2026-119569

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
craftcms craft_cms From 5.10.0 (inc) to 5.11.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Craft CMS versions 5.10.0 to 5.11.1 have an authorization bypass flaw. Authenticated low-privileged users can browse directory structures of volumes they lack permissions for by exploiting the asset replacement feature. They can delete a linked asset and use the replacement volume browser modal to view directory paths, but cannot access file contents.

Detection Guidance

To detect this vulnerability, check Craft CMS version running on your system. If it is between 5.10.0 and 5.11.1, the system is vulnerable. No specific commands are provided in the resources, but monitoring for unauthorized volume browsing attempts in logs may help.

Impact Analysis

An attacker with low privileges could discover sensitive directory structures on your system, potentially exposing information about file organization or paths. This may aid further attacks but does not allow direct file access or data theft.

Compliance Impact

This vulnerability may impact compliance with GDPR and HIPAA by allowing unauthorized access to directory structures, potentially exposing sensitive system information. GDPR requires strict access controls and data protection measures, while HIPAA mandates safeguards for protected health information. The unauthorized browsing of volumes could lead to violations if sensitive data paths are exposed.

Mitigation Strategies

Immediately upgrade Craft CMS to version 5.11.2 or later to patch the vulnerability. Ensure no unauthorized users have access to asset replacement features until the upgrade is complete.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124431. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...