CVE-2026-29113 craftcms CVE debrief

Who should care

Defenders and administrators of Craft CMS installations should be aware of this vulnerability and take steps to update their installations to version 4.17.3 or 5.9.7. Additionally, monitoring for suspicious activity related to preview tokens is recommended. This includes reviewing logs for unusual preview token usage and ensuring that only authorized users have access to preview content. Security teams should also review their asset inventory to ensure that all affected systems are accounted for and remediated. Vulnerability management processes should be updated to include checks for this specific vulnerability in the future. Compensating controls, such as web application firewalls, may be considered to mitigate the risk until updates can be applied. Rollback change windows should be planned to quickly revert systems to a previous state if an update fails or causes issues. Source tracking should be implemented to monitor for any new information related to this vulnerability or similar issues in the future. Patch management procedures should prioritize this update based on the severity of the vulnerability and the potential impact on the organization. Regular security audits should be conducted to ensure that similar vulnerabilities are not present in other systems or applications. Employee training programs should include education on the risks associated with CSRF attacks and the importance of keeping software up-to-date. Incident response plans should be reviewed and updated to include procedures for responding to potential exploitation of this vulnerability. Asset owners should verify that their systems have been updated and that monitoring is in place to detect any potential exploitation. Change management processes should be followed to ensure that updates are properly tested and validated before deployment. Compliance requirements should be reviewed to ensure that the update does not introduce any new regulatory or compliance issues. Communication plans should be developed to inform stakeholders about the vulnerability and the actions being taken to mitigate it. Lessons learned from this incident should be documented and used to improve future security, 7

Technical summary

The Craft CMS preview token endpoint is vulnerable to CSRF attacks, allowing an attacker to force a logged-in victim editor to mint a preview token chosen by the attacker. This token can then be used to access previewed/unpublished content tied to the victim's authorized preview scope. The vulnerability is fixed in Craft CMS versions 4.17.3 and 5.9.7. The issue arises from the endpoint accepting an attacker-supplied previewToken without requiring POST and without enforcing a CSRF token.

Defensive priority

Defenders should prioritize updating Craft CMS to version 4.17.3 or 5.9.7 to address the CSRF vulnerability. Monitoring for suspicious activity related to preview tokens is also recommended.

Recommended defensive actions

• Update Craft CMS to version 4.17.3 or 5.9.7
• Monitor for suspicious activity related to preview tokens
• Implement additional security measures to prevent CSRF attacks
• Review asset inventory to ensure all affected systems are accounted for and remediated
• Plan rollback change windows to quickly revert systems to a previous state if an update fails or causes issues
• Implement source tracking to monitor for any new information related to this vulnerability or similar issues in the future
• Conduct regular security audits to ensure that similar vulnerabilities are not present in other systems or applications

Evidence notes

The CVE record indicates a CSRF vulnerability in Craft CMS versions prior to 4.17.3 and 5.9.7. The vulnerability allows an attacker to force a logged-in victim editor to mint a preview token chosen by the attacker, which can then be used to access previewed/unpublished content tied to the victim's authorized preview scope.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.