CVE-2026-32267 json
Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
published 2026-03-16 7 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-12508 , GHSA-cc7p-2j3x-x7xf
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 9.6%
- EPSS 9.6% chance of exploitation in 30 days, percentile 95%
- public exploits
- 0
- none known
Summary
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.6 and from version 5.0.0-RC1 to before version 5.9.12, a low-privilege user (or an unauthenticated user who has been sent a shared URL) can escalate their privileges to admin by abusing UsersController->actionImpersonateWithToken. This issue has been patched in versions 4.17.6 and 5.9.12.
Patch / fix
- packagist craftcms/cms 4.17.6, 5.9.12
- craftcms craft_cms 4.17.6, 5.9.12
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 7 mo ago
Exploit prediction
9.56% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/craftcms/cms/security/advisories/GHSA-cc7p-2j3x-x7xf referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.7 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 7.7 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | craftcms/cms | >=4.0.0-RC1, <4.17.6 >=5.0.0-RC1, <5.9.12 |
4.17.6 5.9.12 |
Affected products
- craftcms cms
Classification
- Weakness
-
- CWE-863 Incorrect Authorization
References
-
github.com
/craftcms/cms/commit/6301e217c5f15617d939c432cb770db50af14b33
web, patch
-
github.com
/craftcms/cms/security/advisories/GHSA-cc7p-2j3x-x7xf
exploit, web, patch, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-32267
advisory
-
github.com
/craftcms/cms
package
Sources
- CVE List CVE-2026-32267
- GitHub Advisory GHSA-cc7p-2j3x-x7xf
- NVD CVE-2026-32267
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.