CVE-2026-32267CWE-863

Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()

High · published March 16, 2026

CVSS v4.0
7.7
EPSS
1%
Percentile
42.3
In the wild
Unconfirmed
What it is

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.6 and from version 5.0.0-RC1 to before version 5.9.12, a low-privilege user (or an unauthenticated user who has been sent a shared URL) can escalate their privileges to admin by abusing UsersController->actionImpersonateWithToken. This issue has been patched in versions 4.17.6 and 5.9.12.

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00506 · 42.3th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-03-16T19:04Z
EPSS history
Timeline
  • 16 MAR 19:04Z
    Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()
    cvelistv5