CVE-2026-32267

EUVD-2026-12508
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.6 and from version 5.0.0-RC1 to before version 5.9.12, a low-privilege user (or an unauthenticated user who has been sent a shared URL) can escalate their privileges to admin by abusing UsersController->actionImpersonateWithToken. This issue has been patched in versions 4.17.6 and 5.9.12.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 11%
Affected Products (NVD)
VendorProductVersion
craftcmscraft_cms
4.0.0.1 ≤
𝑥
< 4.17.6
craftcmscraft_cms
5.0.1 ≤
𝑥
< 5.9.12
craftcmscraft_cms
4.0.0
craftcmscraft_cms
4.0.0:rc1
craftcmscraft_cms
4.0.0:rc2
craftcmscraft_cms
4.0.0:rc3
craftcmscraft_cms
5.0.0
craftcmscraft_cms
5.0.0:rc1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/craftcms/cms/commit/6301e217c5f15617d939c432cb770db50af14b33
https://github.com/craftcms/cms/security/advisories/GHSA-cc7p-2j3x-x7xf
https://github.com/craftcms/cms/security/advisories/GHSA-cc7p-2j3x-x7xf