CVE-2026-32267 - Vulnerability Analysis

Overview

Craft CMS 4.0.0-RC1 to <4.17.6 and 5.0.0-RC1 to <5.9.12 contain a privilege escalation caused by abuse of UsersController->actionImpersonateWithToken, letting low-privilege or unauthenticated users escalate to admin, exploit requires a shared URL or low-privilege access.

Severity & Score

Impact

Attackers can escalate privileges to admin, gaining full control over the CMS.

Mitigation

Update to versions 4.17.6 or 5.9.12 or later.

References

• https://github.com/craftcms/cms/security/advisories/GHSA-cc7p-2j3x-x7xf
• https://github.com/craftcms/cms/commit/6301e217c5f15617d939c432cb770db50af14b33

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 18, 2026

🔴 CVE-2026-32267 - Critical (9.8) Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.6 and from version 5.0.0-RC1 to before version 5.9.12, a low-privilege user (or an unauthenticated user who has been sent a shared URL) can escalate thei... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32267/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner