CVE-2026-84802 — Craft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController
Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authen…
Published: 2026-09-02 · CVSS: 5.3 · CVSS 4.0
Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to retrieve asset count and total storage size for volumes they cannot access.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7