What is the CVSS score of CVE-2026-32267?

CVE-2026-32267 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Cms are affected by CVE-2026-32267?

Craft CMS versions 4.0.0-RC1 through 4.17.5 and 5.0.0-RC1 through 5.9.11 contain a critical privilege escalation vulnerability that allows any low-privilege or unauthenticated user to gain…. A patch is available.

How to fix or mitigate CVE-2026-32267?

Within 24 hours: Inventory all Craft CMS instances and their versions; disable user impersonation features if operationally feasible; restrict network access to CMS admin interfaces. Within 7 days: Implement WAF rules to block suspicious impersonation token requests; review access logs for exploitation signs. Within 30 days: Apply vendor patches (versions 4.17.6 or 5.9.12+) to all affected systems; conduct security audit of admin accounts and content changes.

Cms CVE-2026-32267

EUVD-2026-12508 CRITICAL

Incorrect Authorization (CWE-863)

2026-03-16 GitHub_M

GHSA-cc7p-2j3x-x7xf

Authentication Bypass Cms

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 16, 2026 - 20:05 euvd

EUVD-2026-12508

Analysis Generated

Mar 16, 2026 - 20:05 vuln.today

CVE Published

Mar 16, 2026 - 19:04 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.6 and from version 5.0.0-RC1 to before version 5.9.12, a low-privilege user (or an unauthenticated user who has been sent a shared URL) can escalate their privileges to admin by abusing UsersController->actionImpersonateWithToken. This issue has been patched in versions 4.17.6 and 5.9.12.

AnalysisAI

A security vulnerability in Craft CMS (CVSS 9.8). Critical severity with potential for significant impact on affected systems.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Access shared URL with impersonation token

Exploit

Call UsersController actionImpersonateWithToken

Execution

Bypass privilege validation

Impact

Escalate to admin account

Access

Access shared URL with impersonation token

Exploit

Call UsersController actionImpersonateWithToken

Execution

Bypass privilege validation

Impact

Escalate to admin account

Vulnerability AssessmentAI

Exploitation	Craft CMS versions 4.0.0-RC1 to before 4.17.6 or 5.0.0-RC1 to before 5.9.12 with UsersController impersonation endpoint accessible via shared URL. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 9.8. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker could exploit this vulnerability in Craft CMS to compromise the security of affected deployments, potentially impacting confidentiality, integrity, or availability.
Remediation	Monitor vendor channels for patch availability. Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Inventory all Craft CMS instances and their versions; disable user impersonation features if operationally feasible; restrict network access to CMS admin interfaces. …

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-32267 vulnerability details – vuln.today

Back

Cms CVE-2026-32267

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Share

External POC / Exploit Code