Executive brief
Craft CMS, a popular content management system, contains a CSRF vulnerability in its preview feature. An attacker can trick a logged-in editor or administrator into unknowingly creating a preview token that the attacker chooses, then use that token to view draft or unpublished content without needing to log in. This could expose sensitive editorial content, upcoming announcements, or unpublished material to unauthorized viewing.
Technical details
The vulnerability exists in the /actions/preview/create-token endpoint, which implements insufficient CSRF protection and accepts GET requests rather than requiring POST. The endpoint accepts an attacker-supplied previewToken parameter and creates a preview token using that exact value. An attacker can exploit this by crafting a malicious URL and using social engineering or HTML injection to trick a logged-in user with preview authorization into visiting it. Once the victim visits the link, the endpoint mints the attacker's chosen preview token tied to the victim's authorization scope. The attacker can then replay this token (e.g., ?token=attacker_value) on the public site to access draft/provisional content without authentication. Exploitation requires the victim to be logged in and have active preview authorization for the target content, and the attacker must know the canonicalId and URL path. Patches are available in versions 4.17.3 and 5.9.7.
Affected products
- Pixel & Tonic Craft CMS >= 4.0.0-RC1, < 4.17.3; >= 5.0.0-RC1, < 5.9.7
Timeline
- 2026-03-09: disclosed: Vulnerability disclosed by security researcher singetu0096
- 2026-03-10: advisory: GitHub Advisory published
- 2026-03-10: patched: Patches released: 4.17.3 and 5.9.7