CVE-2026-32267: Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()

March 16, 2026 (updated October 7, 2026)

A low-privilege user (or an unauthenticated user who has been sent a shared URL) can escalate their privileges to admin by abusing UsersController->actionImpersonateWithToken.

Affected users should update to Craft 4.17.6 and 5.9.12 to mitigate the issue.

References

github.com/advisories/GHSA-cc7p-2j3x-x7xf
github.com/craftcms/cms/commit/6301e217c5f15617d939c432cb770db50af14b33
github.com/craftcms/cms/security/advisories/GHSA-cc7p-2j3x-x7xf
nvd.nist.gov/vuln/detail/CVE-2026-32267

Code Behaviors & Features

Detect and mitigate CVE-2026-32267 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →