GHSA-x76w-8c62-48mg: Craft CMS: Authenticated "assets/preview-thumb" discloses signed fallback transform preview link to CP users without asset-view permission

July 6, 2026

A user with Control Panel access but without permission to view a target private asset can call assets/preview-thumb and receive preview HTML that contains a signed fallback transform link for that private asset.

References

github.com/advisories/GHSA-x76w-8c62-48mg
github.com/craftcms/cms/commit/d30df3112220db1ffd6726a3ed11857014c7fb27
github.com/craftcms/cms/security/advisories/GHSA-x76w-8c62-48mg

Code Behaviors & Features

Detect and mitigate GHSA-x76w-8c62-48mg with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →