CVE-2026-29113
Severity CVSS v4.0:
LOW
Type:
CWE-352
Cross-Site Request Forgery (CSRF)
Publication date:
10/03/2026
Last modified:
12/03/2026
Description
Craft is a content management system (CMS). Prior to 4.17.4 and 5.9.7, Craft CMS has a CSRF issue in the preview token endpoint at /actions/preview/create-token. The endpoint accepts an attacker-supplied previewToken. Because the action does not require POST and does not enforce a CSRF token, an attacker can force a logged-in victim editor to mint a preview token chosen by the attacker. That token can then be used by the attacker (without authentication) to access previewed/unpublished content tied to the victim’s authorized preview scope. This vulnerability is fixed in 4.17.4 and 5.9.7.
Impact
Base Score 4.0
2.30
Severity 4.0
LOW
Base Score 3.x
4.30
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:* | 4.0.0 (including) | 4.17.4 (excluding) |
| cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:* | 5.0.0 (including) | 5.9.7 (excluding) |
To consult the complete list of CPE names with products and versions, see this page