PT-2026-24403 · Craft Cms+1 · Craft Cms+1

Singetu0096 · Published 2026-03-10 · Updated 2026-03-10 · CVE-2026-29113

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Craft versions prior to 4.17.4 Craft versions prior to 5.9.7

Description Craft CMS has a Cross-Site Request Forgery (CSRF) issue in the preview token endpoint. The endpoint, located at /actions/preview/create-token, accepts an attacker-supplied previewToken. The action does not require a POST request and does not enforce a CSRF token, allowing an attacker to force a logged-in editor to generate a preview token chosen by the attacker. This token can then be used by the attacker, without authentication, to access previewed or unpublished content authorized for the victim’s preview scope.

Recommendations Update to Craft version 4.17.4 or later. Update to Craft version 5.9.7 or later.

Exploit

Fix

Improper Authentication

CSRF

Weakness Enumeration

CWE-287

CWE-352

Related Identifiers

CVE-2026-29113

GHSA-VG3J-HPM9-8V5V

Affected Products

Craft

Craft Cms

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29113.json · Exploit
• https://github.com/craftcms/cms/commit/6a88468dc35a27cccc8fef254f415a447d4a07cc · Patch
• https://github.com/craftcms/cms/security/advisories/GHSA-vg3j-hpm9-8v5v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29113 · Security Note
• https://osv.dev/vulnerability/CVE-2026-29113 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vg3j-hpm9-8v5v · Vendor Advisory
• https://github.com/craftcms/cms · Note
• https://twitter.com/infoflowcloud/status/2031505653152227603 · Twitter Post
• https://twitter.com/CVEnew/status/2031504143399932075 · Twitter Post