CVE-2026-84802
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Sep 02, 2026
Vendor
unknown
Description
Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to retrieve asset count and total storage size for volumes they cannot access.