Vulnerability · Published Mar 10, 2026 · Assigned by GitHub_M
CVE-2026-29113Craft has a potential information disclosure vulnerability in preview tokens
Low 2.3
In plain English
A low-severity cross-site request forgery in cms from craftcms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Craft is a content management system (CMS). Prior to 4.17.3 and 5.9.7, Craft CMS has a CSRF issue in the preview token endpoint at /actions/preview/create-token. The endpoint accepts an attacker-supplied previewToken. Because the action does not require POST and does not enforce a CSRF token, an attacker can force a logged-in victim editor to mint a preview token chosen by the attacker. That token can then be used by the attacker (without authentication) to access previewed/unpublished content tied to the victim’s authorized preview scope. This vulnerability is fixed in 4.17.3 and 5.9.7.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | craftcms/cms | 4.17.3 | GHSA-vg3j-hpm9-8v5v |
| Packagist | craftcms/cms | 5.9.7 | GHSA-vg3j-hpm9-8v5v |
Affected products (as reported)
Weakness: CWE-352 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N