CVE-2026-84802

MediumCVSS 4.3/10Last modified Sep 2, 2026

Description

Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to retrieve asset count and total storage size for volumes they cannot access.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
craftcms	cms	>= 5.7.0, < 5.10.12

References

Timeline

Published: Sep 2, 2026
Last modified: Sep 2, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-848039.0SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that mis CVE-2026-848045.4Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoint CVE-2026-848054.3Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/user CVE-2026-848065.4Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit CVE-2026-848075.4Kimai (kimai/kimai) before 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. A CVE-2026-848084.3Kimai versions before 2.65.0 contain an authorization bypass vulnerability in the REST API timesheet collection endpoint that fails to enfor CVE-2026-848096.5Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories an CVE-2026-84819.9IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /CVE-2026-848106.5claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python CVE-2026-848116.5agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scan CVE-2026-848127.1Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.CVE-2026-848139.3Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions.