Craft CMS CVE-2026-56382

Requires valid Craft CMS admin-level authentication to reach the FieldsController::actionRenderCardPreview() endpoint (the CVSS vector specifies PR:H, confirming high-privilege admin access is mandatory, not merely an authenticated low-privilege user). The vulnerable code path is present in default installations of Craft CMS 5.5.0 through 5.9.13 - no non-default configuration toggle is needed beyond the standard CMS being reachable over the network. Limiting factors: admin credentials are required (PR:H), and exploitation is bounded to deployments where the /admin control panel is network-reachable to the attacker, so installations behind VPN, IP allowlists, or SSO with MFA on the admin role materially reduce exposure.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H produces an 8.6 (High), reflecting network-reachable exploitation against the admin control panel with high impact across confidentiality, integrity, and availability - but the PR:H requirement (admin authentication) is the critical limiter. There is no EPSS score, KEV listing, or SSVC decision data provided, and no public exploit has been identified, though the VulnCheck advisory provides detailed technical specifics that materially lower the barrier to weaponization. Practical risk concentrates on Craft CMS deployments where admin credentials may be obtained via phishing, credential reuse, or chained with other flaws - once that prerequisite is met, exploitation is straightforward and yields the CRAFT_SECURITY_KEY, which enables further forgery attacks. This is a real priority for any organization running Craft CMS in the affected range, but not an emergency-patch-tonight scenario absent evidence of in-the-wild activity.

An attacker who has obtained Craft CMS admin credentials (via phishing, credential stuffing, or a separately compromised account) logs into the control panel and sends a crafted POST request to the fields/render-card-preview endpoint with a fieldLayoutConfig payload containing an 'on init' Yii2 event handler that executes arbitrary PHP. The handler reads environment variables and returns the CRAFT_SECURITY_KEY and database credentials, granting the attacker full application takeover and the ability to forge signed tokens. The VulnCheck advisory provides technical detail sufficient for skilled attackers to reproduce, even though no weaponized PoC is publicly identified at time of analysis.