CVE-2026-84802— Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController
Quick assessment
Affected
craftcms cms
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Craft CMS是Craft CMS公司的一套内容管理系统(CMS)。 Craft CMS 5.7.0版本至5.10.12之前版本存在授权问题漏洞，该漏洞源于AssetsController::actionMoveInfo未能执行卷权限检查，经过身份验证的控制面板用户可向assets/move-info端点提交包含任意folderIds的POST请求，检索其无权访问的卷的资源计数和总存储大小，导致信息泄露。
Possible ATT&CK Techniques 3 AI
T1190 · Exploit Public-Facing Application T1124 · System Time Discovery T1214
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84802
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController
Source: CVE Program / CVE List V5
Vulnerability Description
Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to retrieve asset count and total storage size for volumes they cannot access.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Craft CMS 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Craft CMS是Craft CMS公司的一套内容管理系统(CMS)。 Craft CMS 5.7.0版本至5.10.12之前版本存在授权问题漏洞，该漏洞源于AssetsController::actionMoveInfo未能执行卷权限检查，经过身份验证的控制面板用户可向assets/move-info端点提交包含任意folderIds的POST请求，检索其无权访问的卷的资源计数和总存储大小，导致信息泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-84802
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84802
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-84802 (2)
Same Patch Batch · craftcms · 2026-09-02 · 14 CVEs total
| CVE-2026-84795 | 9.8 CRITICAL | Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance |
| CVE-2026-84801 | 8.8 HIGH | Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers |
| CVE-2026-84796 | 8.8 HIGH | Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass |
| CVE-2026-79989 | 8.7 HIGH | Arbitrary user password reset leading to administrator account takeover |
| CVE-2026-79990 | 8.7 HIGH | GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/w |
| CVE-2026-84794 | 7.1 HIGH | Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset |
| CVE-2026-84800 | 7.1 HIGH | Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file |
| CVE-2026-84798 | 7.1 HIGH | Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite |
| CVE-2026-79991 | 7.1 HIGH | Authenticated SQL Injection via nested eager-loading criteria |
| CVE-2026-84797 | 6.3 MEDIUM | Craft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate |
| CVE-2026-84793 | 4.8 MEDIUM | Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name |
| CVE-2026-84792 | 4.3 MEDIUM | Craft CMS before 5.10.11 Broken Access Control via element-indexes |
| CVE-2026-84799 | 4.3 MEDIUM | Craft CMS before 5.11.0 PII Disclosure via GraphQL User Relations |
IV. Related Vulnerabilities
Same product: cms
-
CVE-2026-115938
Low privilege condition filter escapes Twig sandbox, recover -
CVE-2026-115935
Control panel only API response emulation replaces "security -
CVE-2026-113358
LavaLite CMS through 10.1.2 Missing Authentication via Filer -
CVE-2026-112777
Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist B -
CVE-2026-112776
Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via
Same vendor: craftcms
-
CVE-2026-115938
Low privilege condition filter escapes Twig sandbox, recover -
CVE-2026-115937
Unauthenticated payment reuse allows unpaid orders to be mar -
CVE-2026-115935
Control panel only API response emulation replaces "security -
CVE-2026-112777
Craft CMS before 4.18.8 and 5.11.0 Twig create() Blocklist B -
CVE-2026-112776
Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via
Same weakness: CWE-862
-
CVE-2026-116008
DaybydayCRM through 2.2.1 Missing Authorization via Projects -
CVE-2026-114705
WordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken A -
CVE-2026-110892
WordPress SureDash plugin <= 1.12.2 - Broken Access Control -
CVE-2026-115975
Broken access control in JiraController -
CVE-2026-114356
DJI CrystalSky ZS600C DJIUpdateService binder exposes privil
V. Comments for CVE-2026-84802
No comments yet