CVE-2026-29113: 
PHP vulnerability analysis and mitigation

CVE-2026-29113 is a Cross-Site Request Forgery (CSRF) vulnerability in Craft CMS affecting the preview token endpoint at /actions/preview/create-token. The flaw allows an attacker to force a logged-in editor to mint an attacker-controlled preview token, which can then be used without authentication to access unpublished or draft content. Affected versions include Craft CMS 4.0.0-RC1 through 4.17.3 and 5.0.0-RC1 through 5.9.6. Disclosed on March 9, 2026, it carries a CVSS v3.1 score of 4.3 (Medium) and a CVSS v4.0 score of 2.3 (Low) (GitHub Advisory, Github Advisory).

The root cause is classified as CWE-352 (Cross-Site Request Forgery) and CWE-287 (Improper Authentication). The /actions/preview/create-token endpoint accepts a caller-supplied previewToken parameter via GET request without enforcing a CSRF token or requiring a POST method, meaning any cross-origin navigation or link click by a logged-in editor can trigger token creation. Exploitation requires three preconditions: the victim must be logged into the Craft control panel, must have an active preview authorization session for the target content, and the attacker must know the target entry's canonicalId and public URL path. The fix, applied in commit 6a88468, introduces HMAC-signed (hashed) preview tokens server-side, so the previewToken parameter submitted to the endpoint is now validated against a server-generated hash before being accepted (GitHub Advisory, Patch Commit).

Successful exploitation results in unauthorized disclosure of confidential draft, provisional, or revision content that has not yet been published. An attacker can replay the minted preview token unauthenticated to render unpublished content tied to the victim editor's authorization scope. There is no integrity or availability impact, and lateral movement beyond content disclosure is not directly enabled by this vulnerability (GitHub Advisory, Github Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The EPSS score is approximately 0.007–0.008%, placing it in the 1st percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for user interaction and specific session preconditions, limiting its practical attack surface.

1. Reconnaissance: Identify a Craft CMS instance running a vulnerable version (4.0.0-RC1–4.17.3 or 5.0.0-RC1–5.9.6). Enumerate entry canonicalId values and public URL slugs through the site's public-facing content or sitemap.
2. Prepare attacker-controlled token: Choose any fixed 32-character alphanumeric string to serve as the preview token, e.g., aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.
3. Craft the CSRF URL: Construct a GET request URL targeting the vulnerable endpoint with the attacker-chosen token:

   https://TARGET/actions/preview/create-token?elementType=craft%5Celements%5CEntry&canonicalId=123&siteId=1&previewToken=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa&redirect=https%3A%2F%2FTARGET%2F

4. Deliver to victim: Send the crafted URL to a logged-in editor/admin via phishing email, embedded iframe, or redirect. When the victim (who has an active preview session for the target entry) visits the URL, Craft registers the attacker-supplied token.
5. Access unpublished content: Use the known token to retrieve draft/provisional content without authentication:

   curl -i 'https://TARGET/news/known-entry-slug?token=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'

   The response will render the preview/unpublished state of the entry (GitHub Advisory).

• Network: Unusual GET requests to /actions/preview/create-token with a previewToken query parameter originating from unexpected referrers or external IPs; subsequent unauthenticated requests to content URLs with a ?token= parameter matching a known fixed string.
• Logs: Web server or Craft application logs showing GET requests to /actions/preview/create-token with a previewToken parameter that does not match the server-generated token pattern; access log entries for content URLs with static/repeated token values from IPs not associated with the authenticated editor.
• Behavioral: A logged-in editor session triggering preview token creation immediately after visiting an external link or redirect, without the editor actively opening a preview in the control panel.

Craft CMS has released patched versions: 4.17.4 (for the 4.x branch) and 5.9.7 (for the 5.x branch). The fix validates the previewToken parameter against an HMAC-signed hash generated server-side, preventing attackers from supplying arbitrary token values. Organizations unable to patch immediately should implement Content Security Policy (CSP) headers to restrict cross-origin requests and frame embedding, and consider WAF rules to block GET requests to /actions/preview/create-token with external referrers. Editors should be advised not to click untrusted links while logged into the Craft control panel (GitHub Advisory, Patch Commit).

The vulnerability was reported by security researcher singetu0096 and published by Craft CMS maintainer angrybrad on March 9, 2026. The advisory was rated Low severity by the vendor, consistent with the limited impact scope (confidentiality only, requires user interaction). No significant broader media coverage or notable community debate has been identified beyond standard CVE tracking and aggregator publications (GitHub Advisory).