CVE-2026-32267 in Craft
Summary
by MITRE • 03/16/2026
Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.6 and from version 5.0.0-RC1 to before version 5.9.12, a low-privilege user (or an unauthenticated user who has been sent a shared URL) can escalate their privileges to admin by abusing UsersController->actionImpersonateWithToken. This issue has been patched in versions 4.17.6 and 5.9.12.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 03/21/2026
This vulnerability exists within Craft CMS, a popular content management system that serves as a foundational platform for web content management. The flaw resides in the privilege escalation mechanism within the UsersController class, specifically in the actionImpersonateWithToken method that handles user impersonation functionality. The vulnerability affects versions from 4.0.0-RC1 through 4.17.5 and from 5.0.0-RC1 through 5.9.11, creating a significant security gap that could allow unauthorized users to gain administrative privileges.
The technical flaw represents a critical authorization bypass vulnerability that stems from improper validation of authentication tokens used for user impersonation. When a low-privilege user or unauthenticated user accesses a shared URL containing a valid impersonation token, the system fails to properly verify whether the requesting user has legitimate authorization to assume administrative privileges. This weakness allows attackers to exploit the token-based impersonation feature without proper authentication, effectively bypassing the standard access control mechanisms that should prevent such privilege escalation.
The operational impact of this vulnerability is severe as it enables attackers to gain full administrative control over Craft CMS installations without requiring legitimate administrative credentials or accounts. This represents a direct violation of the principle of least privilege and could lead to complete system compromise, data exfiltration, modification of content, and potential lateral movement within network environments where the CMS operates. The vulnerability affects both authenticated users with limited privileges and completely unauthenticated users who obtain access through shared URLs, significantly expanding the attack surface.
From a cybersecurity perspective, this vulnerability maps to CWE-285 (Improper Authorization) and aligns with ATT&CK technique T1078 (Valid Accounts) and T1548.001 (Abuse Elevation Control Mechanism). The flaw demonstrates poor input validation and insufficient access control checks during token processing. Organizations using affected Craft CMS versions face significant risk of unauthorized administrative access, potentially leading to complete system compromise. The patch implemented in versions 4.17.6 and 5.9.12 addresses this by strengthening token validation and ensuring proper authorization checks before allowing privilege escalation. System administrators should immediately upgrade to the patched versions and review access controls for shared URLs and token-based access mechanisms to prevent exploitation of this vulnerability.