PT-2026-21610 · Craft Cms · Craft Cms

Vitalysim

·

Published

2026-02-23

·

Updated

2026-02-24

·

CVE-2026-27128

CVSS v4.0

6.9

Medium

VectorAV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Craft versions 4.5.0-RC1 through 4.16.18 Craft versions 5.0.0-RC1 through 5.8.22
Description Craft CMS contains a Time-of-Check-Time-of-Use (TOCTOU) race condition within its token validation service, specifically affecting tokens configured for limited usage. The getTokenRoute() method performs non-atomic operations, reading a token’s usage count, verifying its limits, and then updating the database. An attacker can exploit this by sending multiple concurrent requests, potentially reusing a single-use impersonation token before the database update is finalized. Successful exploitation requires obtaining a valid, non-expired impersonation URL and bypassing any rate-limiting mechanisms. If the impersonation URL grants access to an account with higher privileges than the current user, this could lead to privilege escalation.
Recommendations Craft versions 4.5.0-RC1 through 4.16.18 should be updated to version 4.16.19 or later. Craft versions 5.0.0-RC1 through 5.8.22 should be updated to version 5.8.23 or later.

Exploit

Fix

LPE

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2026-27128
GHSA-6FX5-5CW5-4897

Affected Products

Craft Cms