Craft CMS is a content management system (CMS).

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Mar 16, 2026 · NIST NVD

   Detected

   Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.6 and from version 5.0.0-RC1 to before version 5.9.12, a low-privilege user (or an unauthenticated user who has been sent a shared URL) can escalate their privileges to admin by abusing UsersController->actionImpersonateWithToken. This issue has been patched in versions 4.17.6 and 5.9.12.

2. Jun 17, 2026 · NIST NVD

   Updated

   Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.6 and from version 5.0.0-RC1 to before version 5.9.12, a low-privilege user (or an unauthenticated user who has been sent a shared URL) can escalate their privileges to admin by abusing UsersController->actionImpersonateWithToken. This issue has been patched in versions 4.17.6 and 5.9.12.

Affected

• cpe craftcms/craft cmsversion unspecified
• cpe craftcms/craft cms4.0.0
• cpe craftcms/craft cms5.0.0

Sources

• CVE.orgVulnerability recordCVE-2026-32267

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-32267

  Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.6 and from version 5.0.0-RC1 to before version 5.9.12, a low-privilege user (or an unauthenticated user who has been sent a shared URL) can escalate their privileges to admin by abusing

  nvd.nist.gov

References

• Patch · github.com
• Exploit · github.com