medium4.3
CVE-2026-84802
Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume p…
Impact
Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to retrieve asset count and total storage size for volumes they cannot access.
Affected products
| Product | Affected versions |
|---|---|
| Craft CMS Versions From 5.7.0 | before 5.10.12 |
Versions were read from the advisory text. No structured product data has been published for this record yet.