CVE ID :CVE-2026-32267 Published : March 16, 2026, 7:04 p.m. | 1 hour, 4 minutes ago Description :Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.6 and from version 5.0.0-RC1 to before version 5.9.12, a low-privilege user (or an unauthenticated user who has been sent a shared URL) can escalate their privileges to admin by abusing UsersController->actionImpersonateWithToken. This issue has been patched in versions 4.17.6 and 5.9.12. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...