CVE-2026-32267: 
PHP vulnerability analysis and mitigation

CVE-2026-32267 is a privilege escalation vulnerability in Craft CMS affecting the UsersController->actionImpersonateWithToken() function. It allows a low-privilege user — or an unauthenticated user who has received a shared preview URL — to escalate their privileges to administrator level. Affected versions span from 4.0.0-RC1 to before 4.17.6 and from 5.0.0-RC1 to before 5.9.12. The vulnerability was published on March 16, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 7.7 (High) (Github Advisory, Craft CMS Advisory).

The root cause is an incorrect authorization check (CWE-863) in the actionImpersonateWithToken() endpoint. The actionPreview() method re-dispatches requests with $skipSpecialHandling=true and $checkToken=false, which bypasses security guards and allows an attacker-controlled action query parameter to redirect the request to the impersonation endpoint. The requireToken() guard on actionImpersonateWithToken() only checks a boolean flag (_hadToken) indicating that any valid token was present — it does not verify that the token was issued for the impersonation action specifically. Because actionImpersonateWithToken is listed in $allowAnonymous and performs no further authorization, any valid preview token (easily obtained by any editor) can be weaponized to impersonate any user, including administrators. The fix (commit 6301e21) changes requireToken() to verify that the token's resolved route matches the current route, preventing cross-action token reuse (Craft CMS Advisory, Patch Commit).

Successful exploitation grants an attacker full administrative access to the Craft CMS instance without requiring valid admin credentials. An attacker with admin access can read, modify, or delete all CMS content and user data (high confidentiality, integrity, and availability impact), install plugins, modify site templates, and potentially achieve server-side code execution depending on the hosting environment. This vulnerability primarily affects Craft Pro and Team editions where multiple user roles exist, but any instance with preview functionality enabled is at risk (Github Advisory).

A detailed proof-of-concept (PoC) exploit with step-by-step reproduction instructions is publicly available in the official security advisory, confirmed by Feedly threat intelligence as a high-confidence real exploit (Craft CMS Advisory). The vulnerability was discovered by a security researcher at Anthropic using LLM-assisted analysis and manually validated. As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and the CVE is not listed in the CISA KEV catalog. The EPSS score is approximately 0.017% (low probability of near-term exploitation), though the public PoC lowers the barrier to exploitation significantly (Github Advisory).

1. Obtain a low-privilege account or shared preview URL: Log in to the Craft CMS instance as any editor-level user, or obtain a shared preview URL sent by another user.
2. Create a content entry: Navigate to Entries, create a new entry in any section (e.g., a Blog channel), and save it.
3. Open the preview pane: Open the saved entry in the editor and click the "Preview" button to open the live preview pane.
4. Extract the preview token: Right-click inside the preview iframe and use browser developer tools (Inspect Element) to locate the <iframe> element. Its src attribute contains a URL with a token=XXXXXXXX parameter. Copy this token value.
5. Craft the exploit URL: Construct a URL targeting the impersonation endpoint: http://[target-host]/?token=XXXXXXXX&action=users/impersonate-with-token&userId=1&prevUserId=1 (where userId=1 typically corresponds to the first admin account).
6. Execute the exploit: Open a new incognito/private browser window and navigate to the crafted URL. A 404 response may appear — this is expected behavior.
7. Verify admin access: In the same incognito tab, navigate to http://[target-host]/admin. If successful, the attacker will be logged in as the administrator without ever entering credentials (Craft CMS Advisory).

• Network: Unexpected HTTP GET requests to /?action=users/impersonate-with-token&userId=1&prevUserId=1 (or similar userId values) combined with a token= parameter in the query string; requests originating from IP addresses with no prior authenticated session history.
• Logs: Web server access logs showing requests to the impersonation endpoint (users/impersonate-with-token) from unauthenticated sessions or sessions with only low-privilege history; Craft CMS application logs recording admin session creation without a corresponding admin login event.
• Application Behavior: Admin-level actions (plugin installation, template modification, user creation) performed by accounts that have no record of admin login in authentication logs; sudden appearance of new admin accounts or modified user roles.
• Session: Admin session cookies issued to IP addresses or user agents inconsistent with the legitimate admin's access patterns (Craft CMS Advisory).

Craft CMS has released patched versions 4.17.6 (for the 4.x branch) and 5.9.12 (for the 5.x branch), which fix the vulnerability by ensuring requireToken() validates that the token's resolved route matches the current action route. Administrators should upgrade immediately. As a supplementary measure, review and revoke any shared preview tokens that may have been exposed, and audit admin account activity logs for unauthorized impersonation events. No configuration-based workaround is available that fully mitigates the issue without upgrading (Craft CMS Advisory, Patch Commit).

The vulnerability was discovered by a security researcher at Anthropic using LLM-assisted vulnerability research, which drew notable attention to the role of AI in security research. The advisory was shared on Mastodon by The Hacker Wire and discussed by the offseq security account, indicating moderate community interest. Qualys added detection for this vulnerability in their March 2026 application security detections update. Check Point also published an advisory (CPAI-2026-6406) covering this vulnerability (Craft CMS Advisory).