{"action":"Upgrade craftcms/cms to 4.17.8 or later.","affected":[{"fixed":"5.9.14","introduced":"5.0.0-RC1"},{"fixed":"4.17.8","introduced":"4.0.0-RC1"}],"component":"craftcms/cms","cve_ids":["CVE-2026-56385"],"ecosystem":"Packagist","epss":0.00359,"exploited":false,"fixed_versions":["5.9.14","4.17.8"],"ghsa_id":"GHSA-44px-qjjc-xrhq","id":"tcs_01M5KETK66T6A9EWXA7QSQMWY8","modified_at":"2026-08-06T22:00:56.129214586Z","published_at":"2026-03-26T17:12:21Z","references":["https://osv.dev/vulnerability/GHSA-44px-qjjc-xrhq","https://github.com/craftcms/cms/security/advisories/GHSA-44px-qjjc-xrhq","https://nvd.nist.gov/vuln/detail/CVE-2026-56385","https://github.com/craftcms/cms/commit/b1cddf72c98a66801beb04ea4b07e72182b7b7db","https://github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27","https://github.com/craftcms/cms","https://www.vulncheck.com/advisories/craft-cms-authorization-bypass-in-assets-preview-file-endpoint"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-44px-qjjc-xrhq","url":"https://osv.dev/vulnerability/GHSA-44px-qjjc-xrhq"},{"source":"nvd","source_id":"CVE-2026-56385","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56385"}],"summary":"Craft CMS: Authorized asset \"preview file\" requests bypass allows users without asset access to retrieve private preview metadata"}