Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken

1. Executive summary

Craft CMS versions before 4.17.6 and 5.9.12 contain an authentication bypass and privilege escalation flaw in UsersController->actionImpersonateWithToken(), tracked as CVE-2026-32267. Any user holding a valid preview token, which an editor can generate simply by creating an entry and clicking Preview, can append a crafted query string to that URL and be logged in as any user including the administrator, with no credentials and no prior authentication. Craft Solo deployments are affected but the practical impact is greatest on Craft Pro and Team, where multiple editor accounts and preview workflows are in normal use. For EMEA financial services clients running Craft as a public-facing CMS, the exposure is full administrative takeover of the site, which carries content-integrity, data-access and downstream supply-chain consequences. No CVSS score, severity rating or CISA KEV exploitation status is available in the verified reference data for this item; the assessment below rests on the vendor advisory alone.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

The flaw is a vendor-side software defect in a CMS product. The regulatory reference supplied does not include an article whose trigger fact is distinctive to this item and would change what a client must do. Whether DORA Art. 17, Art. 18 or Art. 19, NIS2 Art. 23, or UK NIS 2018 duties are engaged depends on facts not present here: whether the Craft instance is in scope for the client's regulated service, whether an exploitation attempt actually occurred, and whether it met the client's own incident classification thresholds. Those determinations sit with the client's incident process, not with this advisory.

3. Technical analysis & attack chain

The vulnerability is a request re-dispatch flaw in Craft's preview handling that lets an attacker-controlled action parameter override the dispatch target and reach the impersonation endpoint without authentication. The vendor advisory is the only source; every technical claim below is single-sourced to it.

Confirmed attack chain:

The attacker obtains a valid preview token. The advisory states this is easy: an editor creates a single entry, clicks Preview, and the token appears in the token= parameter of the preview iframe's src. The tokenized URL has the form http://host/blog/title?x-craft-live-preview=...&token=XXXXXXXX.
The attacker appends &action=users/impersonate-with-token&userId=1&prevUserId=1 to that preview URL and requests it. userId=1 targets the administrator account.
The request is re-dispatched into actionImpersonateWithToken(). Three conditions make this work together: - actionPreview() passes $skipSpecialHandling=true to handleRequest(), which bypasses the security guards, and passes $checkToken=false to checkIfActionRequest(), which allows the attacker-supplied action query parameter to override the dispatch target. - The requireToken() guard on actionImpersonateWithToken() checks only the boolean _hadToken, set when the preview token was first resolved. It does not verify that the token was issued for the impersonation action, so any valid token from any route satisfies the check. - actionImpersonateWithToken is listed in $allowAnonymous and performs no authorization beyond requireToken(), so no prior authentication is required.
The response may be a 404. The advisory states this is expected and does not indicate failure.
The attacker navigates to /admin in the same session and lands on the admin dashboard, authenticated as the administrator, without entering credentials.

The proof of concept was demonstrated against Craft CMS 5.9.10 and achieves full admin takeover. The advisory does not describe persistence, command-and-control, lateral movement, or data exfiltration steps; the impact is the administrative session itself, from which any action available to an admin follows.

Affected and fixed versions: Craft CMS before 4.17.6 and before 5.9.12 are vulnerable. The vendor fix is to update to 4.17.6 or 5.9.12.

Confidence caveat: this is a single-source advisory. The mechanism, the PoC and the version ranges have not been corroborated by a second vendor or by CISA KEV data, which is absent for this item. Treat the exploitation steps as accurate to the vendor's own description and verify against your Craft build before relying on them for detection tuning.

4. Mitigation & containment

P1 (within 24 hours)

Identify every Craft CMS instance in the estate and record its exact version. Anything below 4.17.6 on the 4.x line, or below 5.9.12 on the 5.x line, is vulnerable.
Update to Craft 4.17.6 or 5.9.12. This is the vendor fix and the only complete remediation.
Where an instance cannot be patched inside 24 hours, restrict access to the preview and impersonation routes at the edge. Block requests whose query string contains action=users/impersonate-with-token and block the x-craft-live-preview parameter from untrusted sources. This is a compensating control, not a fix.
Review web and application logs for requests containing action=users/impersonate-with-token, particularly those carrying a token= parameter and a userId= value. Any such request from an unauthenticated or low-privilege session is a probable exploitation attempt.
Rotate administrator credentials and invalidate active sessions on any instance where such a request is found, then review the admin audit trail for actions taken after the suspected session.

P2 (within 72 hours)

Audit editor and author accounts. The token needed for exploitation is generated by ordinary preview use, so any account able to create or preview an entry is a potential token source. Confirm which accounts hold that capability and whether they need it.
Check for rogue admin accounts, changed email addresses on existing admin accounts, and modified user permissions, since these are the actions an attacker with an admin session would take to retain access.
If the Craft instance is internet-facing, confirm whether the preview token could have been observed by a third party, for example through a shared URL, a proxy log, or a referrer header.

P3 (within 7 days)

Add the action=users/impersonate-with-token pattern to WAF and reverse-proxy rules as a standing block, so a future regression or an unpatched instance is caught at the edge.
Add Craft CMS version checks to the asset inventory so future advisories can be matched to deployed versions without a manual sweep.
Review whether preview tokens are exposed in logs, analytics, or third-party embeds, and remove them where they are.

5. Indicators of compromise

No indicators of compromise available in the source material.

The source describes observable behaviours but no atomic indicators such as hashes, domains, or IP addresses. The behaviours below are the exploitable request patterns and the post-exploitation state to look for.

Behavioural indicators

behaviour	where to observe	confidence
Request to a preview URL with `action=users/impersonate-with-token` appended, carrying `token=` and `userId=` parameters	Web server access logs, reverse-proxy logs, WAF logs	High, single-sourced to vendor advisory
A 404 response to a request containing `action=users/impersonate-with-token`, followed by a successful authenticated request to `/admin` from the same client	Web server access logs correlated with application session logs	High, single-sourced to vendor advisory
An admin session established without a corresponding login event in the authentication log	Craft application logs, SSO or IdP logs	Medium, inferred from the advisory's description of credential-free admin access
Preview token values appearing in logs, referrer headers, or third-party requests	Web server logs, browser telemetry, CDN logs	Medium, inferred from the token being carried in a URL query string

6. Detection

The source provides distinctive request artefacts: the action=users/impersonate-with-token parameter value, the userId and prevUserId parameters, and the x-craft-live-preview parameter. These are exact strings from the advisory and are suitable for a Sigma rule against web access logs. A YARA rule is not appropriate here: the flaw is in application request handling, not in a file artefact, and the source provides no file strings, mutexes, or command lines to match on.

title: Craft CMS Impersonation Endpoint Abuse via Preview Token
id: 7f3c1a92-4b6e-4d21-9c8a-2e5f0d7b1a44
status: experimental
description: Detects requests that abuse the Craft CMS action re-dispatch flaw in actionPreview to reach actionImpersonateWithToken using a preview token, as described in CVE-2026-32267.
author: Adverse Trace
date: 2026-10-07
references:

  - https://github.com/advisories/GHSA-cc7p-2j3x-x7xf
logsource:
  category: webserver
detection:
  selection_action:
    cs-uri-query|contains: 'action=users/impersonate-with-token'
  selection_user:
    cs-uri-query|contains:

      - 'userId='
      - 'prevUserId='
  selection_preview:
    cs-uri-query|contains: 'x-craft-live-preview'
  condition: selection_action and (selection_user or selection_preview)
fields:

  - c-ip
  - cs-uri-query
  - sc-status
falsepositives:

  - Legitimate administrator use of the impersonation feature, which is expected to carry an authenticated session. Correlate with the authentication log to separate the two.
level: high

7. Sources

GitHub Advisory Database, "Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()", https://github.com/advisories/GHSA-cc7p-2j3x-x7xf, published 2026-03-16.

8. Adverse Trace position

Adverse Trace assesses this as a high-impact authentication bypass in a widely deployed CMS, with the caveat that no CVSS score, severity rating or CISA KEV exploitation status is available in the verified reference data for this item, so the rating rests on the vendor advisory alone and is single-sourced. The practical risk to a client is full administrative takeover of any Craft instance below 4.17.6 or 5.9.12 that is reachable by an editor or by anyone who has been sent a preview URL, and the exploitation path requires no credentials and no special tooling. We will track for a CVE record, a CVSS assignment and any KEV addition, and will reissue this advisory if the exploitation status changes. Clients running Craft should treat the version check and the update to 4.17.6 or 5.9.12 as the immediate action, and should search their access logs for the action=users/impersonate-with-token pattern before assuming they were not targeted.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.