CVE-2026-32267 is a critical privilege escalation flaw in Craft CMS, scored CVSS 9.8. A low-privilege user, or an unauthenticated person holding a shared preview URL, can become an administrator through the impersonation action. Craft 4.17.6 and 5.9.12 fix it, so update any 4.x or 5.x site now.
What's affected
The NVD record and the GitHub advisory agree on the ranges:
- Craft CMS 4.0.0-RC1 up to and including 4.17.5. Fixed in 4.17.6.
- Craft CMS 5.0.0-RC1 up to and including 5.9.11. Fixed in 5.9.12.
The package is craftcms/cms on Composer. The advisory says the issue matters most for Craft Pro and Team, where several people hold accounts, and less for Craft Solo.
The weakness sits in the users controller, in the action that lets one account impersonate another using a token.
How to check if you're exposed
Find the installed version from your project root:
composer show craftcms/cms
You can also read the locked version directly:
grep -A1 '"name": "craftcms/cms"' composer.lock
Compare the result with 4.17.6 (for the 4 line) or 5.9.12 (for the 5 line). Anything below those, on either line, is exposed.
Then ask who can reach the site. The advisory notes that a person with a valid preview token is enough, and editors create preview tokens in normal work. Shared preview links count as sensitive until you have patched.
What to do now
- Update Craft to 4.17.6 or 5.9.12 or later. With Composer, run composer update craftcms/cms and confirm the lock file now shows a fixed version.
- Deploy the update to every environment, including staging and any copies that editors can reach.
- Review administrator accounts and recent sessions. Look for admin logins or changes you cannot tie to a person.
- Treat shared preview URLs as credentials until you have patched, and avoid sending them outside your team.
- Reduce the number of accounts that can create previews or edit entries, where your workflow allows it.
Why it matters
The class is CWE-863, incorrect authorization. According to the advisory, a preview request was passed back through the application's dispatcher in a way that skipped the usual security guards. The guard on the impersonation action then only checked that some token had been resolved earlier in the request. It did not check that the token was meant for impersonation. Because that action is open to anonymous callers, no earlier login was needed.
In plain terms, a ticket for one door opened a different door. Any token from any route satisfied the check. The record's KEV flag is false, and the advisory does not report exploitation in the wild. It does call the bug fairly serious, and the fix is a small, safe upgrade.
Sites with many editors carry the most risk, because each editor can obtain a preview token as part of ordinary work.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to be logged in for this to work?
The advisory says a low-privilege user can escalate, and in extreme cases an unauthenticated user who has been sent a shared URL can do the same. Patch regardless of how many accounts you have.
Is Craft Solo affected?
The advisory says Craft Pro and Team are affected more than Solo, which implies Solo is affected less, not that it is safe. Update it too.
Sources
Last reviewed: 19 October 2026.
