Description

Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to retrieve asset count and total storage size for volumes they cannot access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-02T12:17:17.050Z",
  "pubdate": "2026-09-02T12:17:17.050Z",
  "executiveSummary": "Craft CMS versions 5.7.0 through 5.10.11 contain an information disclosure vulnerability within the AssetsController component.\nThe vulnerability resides in the actionMoveInfo method, which fails to perform necessary authorization checks regarding volume permissions.\nThis flaw allows an authenticated control panel user, regardless of their standard permission set, to query metadata concerning assets located in directories they are not explicitly authorized to access.\nThe impact includes the unauthorized exposure of internal asset volume data, specifically asset counts and total storage utilization metrics.\nWhile this is an information disclosure issue, it potentially facilitates reconnaissance for more advanced attacks by revealing the structure and scale of managed assets.\nExploitation requires active authentication within the Craft CMS control panel and the ability to craft valid HTTP POST requests targeting the specific endpoint.\nThe vulnerability represents a failure in access control implementation during the asset management workflow.",
  "technicalDetails": "The vulnerability is situated within the AssetsController::actionMoveInfo function, a component of the Craft CMS administrative interface responsible for providing metadata previews when moving asset files between volumes.\nThe root cause is an improper authorization check during the execution flow. When a request is dispatched to the assets/move-info endpoint, the system is expected to validate that the authenticated user possesses the 'view' or 'edit' permissions for the specific volume requested via the folderId parameter.\nAnalysis indicates that the current implementation fails to enforce these permission constraints, allowing the application to process the request even when the folderId refers to a restricted volume.\nThe attack flow begins when an authenticated control panel user submits a malicious POST request to the assets/move-info endpoint. The payload includes an arbitrary folderId corresponding to a protected or restricted asset volume.\nUpon receiving the request, the application backend retrieves the requested folder information from the database without verifying the user's access rights to that specific asset source.\nThe controller then computes the requested metadata, including the total number of assets contained within the folder and the aggregate storage size consumed by these assets.\nThis sensitive metadata is then serialized into the HTTP response body and returned to the attacker. Because the application logic does not validate the security context against the requested resource ID, the system essentially acts as an oracle for asset volume statistics.\nThe vulnerability affects Craft CMS versions 5.7.0 and remains present in all subsequent versions up to 5.10.11.\nThe exploit does not require administrative privileges, merely a valid, authenticated session within the control panel. This highlights a significant breakdown in the principle of least privilege, as users with limited scope access can inspect data from unauthorized volumes.\nPost-exploitation impact is primarily limited to information disclosure; however, the exposure of precise storage metrics and asset volume quantities provides an attacker with reconnaissance data that can inform social engineering or target identification for further exploitation attempts within the infrastructure."
}