Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Craft is a platform for creating digital experiences. In Craft versions from 4.0.0-RC1 to before 4.17.0-beta.1 and 5.9.0-beta.1, there is a Privilege Escalation vulnerability in Craft CMS’s GraphQL API that allows an authenticated user with write access to one asset volume to escalate their privileges and modify/transfer assets belonging to any other volume, including restricted or private volumes to which they should not have access. The saveAsset GraphQL mutation validates authorization against the schema-resolved volume but fetches the target asset by ID without verifying that the asset belongs to the authorized volume. This allows unauthorized cross-volume asset modification and transfer. This vulnerability is fixed in 4.17.0-beta.1 and 5.9.0-beta.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 1 product
CVE-2026-25497 Craft is a platform for creating digital experiences. In Craft versions from 4.0.0-RC1 to before 4.17.0-beta.1 and 5.9.0-beta.1, there is a Privilege Escalation vulne… https://www.cve.org/CVERecord?id=CVE-2026-25497
Post summary
The CVE-2026-25497 vulnerability is a privilege escalation issue affecting specific Craft platform versions, with details provided but no evidence of exploitation or patch availability.
CVE-2026-25497: Craft CMS: The Old GraphQL Switcheroo A high-severity privilege escalation vulnerability in Craft CMS allows authenticated users with write access to any asset volume to manipulate assets in volumes they shouldn't be able to touch. By ... https://cvereports.com/reports/CVE-2026-25497
Post summary
The post announces CVE-2026-25497 as a high‑severity privilege escalation flaw in Craft CMS, allowing authenticated users with write access to manipulate assets in unauthorized volumes.
CVE-2026-25497 Privilege Escalation in Craft CMS GraphQL API Enables Unauthorized Asset Manipulation https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-25497
Post summary
The text announces a privilege‑escalation vulnerability in Craft CMS’s GraphQL API that allows unauthorized asset manipulation, with details posted on Vulmon but no PoC, exploit, or patch information.
7 of 7 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | craftcms | craft_cms | - | - | - |
| App | craftcms | craft_cms | 4.0.0 | - | - |
| App | craftcms | craft_cms | 4.0.0 | - | - |
| App | craftcms | craft_cms | 4.0.0 | - | - |
| App | craftcms | craft_cms | 4.0.0 | - | - |
| App | craftcms | craft_cms | 5.0.0 | - | - |
| App | craftcms | craft_cms | 5.0.0 | - | - |