What is the CVSS score of CVE-2026-32267?

CVE-2026-32267 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Cms are affected by CVE-2026-32267?

Craft CMS versions 4.0.0-RC1 through 4.17.5 and 5.0.0-RC1 through 5.9.11 contain a critical privilege escalation vulnerability that allows any low-privilege or unauthenticated user to gain…. A patch is available.

How to fix or mitigate CVE-2026-32267?

Within 24 hours: Inventory all Craft CMS instances and their versions; disable user impersonation features if operationally feasible; restrict network access to CMS admin interfaces. Within 7 days: Implement WAF rules to block suspicious impersonation token requests; review access logs for exploitation signs. Within 30 days: Apply vendor patches (versions 4.17.6 or 5.9.12+) to all affected systems; conduct security audit of admin accounts and content changes.

Cms CVE-2026-32267

EUVD-2026-12508 CRITICAL

Incorrect Authorization (CWE-863)

2026-03-16 GitHub_M

GHSA-cc7p-2j3x-x7xf

Authentication Bypass Cms

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 16, 2026 - 20:05 euvd

EUVD-2026-12508

Analysis Generated

Mar 16, 2026 - 20:05 vuln.today

CVE Published

Mar 16, 2026 - 19:04 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.6 and from version 5.0.0-RC1 to before version 5.9.12, a low-privilege user (or an unauthenticated user who has been sent a shared URL) can escalate their privileges to admin by abusing UsersController->actionImpersonateWithToken. This issue has been patched in versions 4.17.6 and 5.9.12.