CVE-2026-124431
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Nov 08, 2026
Vendor
unknown
Description
Craft CMS from 5.10.0 before 5.11.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to browse volumes they lack permissions for. Attackers can delete a linked asset and use the replacement volume browser modal to view directory structures of all volumes, though not file contents.