CVE-2026-27128

Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a Time-of-Check-Time-of-Use (TOCTOU) race condition exists in Craft CMS’s token validation service for tokens that explicitly set a limited usage. The getTokenRoute() method reads a token’s usage count, checks if it’s within limits, then updates the database in separate non-atomic operations. By sending concurrent requests, an attacker can use a single-use impersonation token multiple times before the database update completes. To make this work, an attacker needs to obtain a valid user account impersonation URL with a non-expired token via some other means and exploit a race condition while bypassing any rate-limiting rules in place. For this to be a privilege escalation, the impersonation URL must include a token for a user account with more permissions than the current user. Versions 4.16.19 and 5.8.23 patch the issue.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-367"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27128.json"
}

References

Affected packages

Git / github.com/craftcms/cms

Affected ranges

Type

GIT

Repo

https://github.com/craftcms/cms

Events

Introduced

Fixed

1a8db788c8b3de85c3aed09ac34046e230079481

Fixed

daf0ed01c7d2c194ba4a405290e43934d020eef2

Introduced

3395410ff69229a3fa3cdd16f677bb08a6f80f0e

Fixed

3e4afe18279951c024c64896aa2b93cda6d95fdf

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "4.16.19"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "5.8.23"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:craftcms:craft_cms:4.5.0:-:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "4.5.0-NA"
                },
                {
                    "last_affected":  "4.5.0-NA"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:craftcms:craft_cms:5.0.0:-:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "5.0.0-NA"
                },
                {
                    "last_affected":  "5.0.0-NA"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:craftcms:craft_cms:5.0.0:rc1:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "5.0.0-rc1"
                },
                {
                    "last_affected":  "5.0.0-rc1"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "range":  [
                {
                    "fixed":  "3e4afe18279951c024c64896aa2b93cda6d95fdf"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*

0.9.2063

0.9.2064

0.9.2065

0.9.2068

0.9.2071

0.9.2078

0.9.2079

0.9.2080

0.9.2081

0.9.2083

0.9.2090

0.9.2094

0.9.2100

0.9.2101

0.9.2102

0.9.2103

0.9.2106

0.9.2116

0.9.2117

0.9.2123

0.9.2124

0.9.2146

0.9.2151

0.9.2157

0.9.2167

0.9.2168

0.9.2177

0.9.2181

0.9.2184

0.9.2189

0.9.2193

0.9.2243

0.9.2246

1.*

1.0.0-alpha.2236

1.0.0-alpha.2237

1.0.0-alpha.2238

1.0.0-alpha.2241

1.0.0-alpha.2242

1.0.0-alpha.2244

1.0.0-alpha.2245

1.0.0-alpha.2247

1.0.0-alpha.2248

1.0.0-alpha.2249

1.0.2266

1.1.0-alpha.2283

1.1.0-alpha.2284

1.1.0-alpha.2285

1.1.0-alpha.2288

1.1.2291

1.2.0-alpha.2310

1.2.0-alpha.2312

1.2.0-alpha.2318

1.2.0-alpha.2319

1.2.0-alpha.2322

1.2.0-alpha.2328

1.2.0-alpha.2329

1.2.2333

1.2.2335

1.2.2336

1.2.2339

1.4.0-alpha.2488

1.4.0-alpha.2489

1.4.0-alpha.2490

1.4.0-alpha.2491

1.4.0-alpha.2492

1.4.0-alpha.2493

1.4.0-alpha.2497

1.4.0-alpha.2498

1.4.0-alpha.2499

1.4.0-alpha.2500

1.4.0-alpha.2502

1.4.0-alpha.2503

1.4.0-alpha.2505

1.4.0-alpha.2509

2.*

2.0.2524

2.0.2525

2.0.2527

2.0.2532

2.0.2533

2.0.2535

2.0.2536

2.0.2537

2.0.2538

2.0.2539

2.1.0-alpha.2546

2.1.0-alpha.2547

2.1.0-alpha.2552

2.1.2554

2.1.2555

2.1.2556

2.1.2557

2.2.0-alpha.2578

2.2.2579

2.2.2581

2.3.0-alpha.2600

2.3.0-alpha.2602

2.3.0-alpha.2603

2.3.0-alpha.2605

2.3.0-alpha.2606

2.3.0-alpha.2608

2.3.0-alpha.2610

2.3.0-alpha.2612

2.3.2615

2.3.2616

2.3.2617

3.*

3.0.0-alpha.2671

3.0.0-alpha.2681

3.0.0-alpha.2687

3.0.0-alpha.2915

3.0.0-alpha.2918

3.0.0-alpha.2928

3.0.0-alpha.2933

3.0.0-alpha.2937

3.0.0-alpha.2939

3.0.0-alpha.2942

3.0.0-alpha.2948

4.*

4.10.0-beta.1

4.10.0-beta.2

4.11.0

4.11.0.1

4.11.0.2

4.12.0

4.13.0

4.13.1

4.13.1.1

4.13.10

4.13.2

4.13.3

4.13.4

4.13.5

4.13.6

4.13.8

4.13.9

4.14.0

4.14.0.1

4.14.0.2

4.14.1

4.14.10

4.14.11

4.14.11.1

4.14.12

4.14.13

4.14.14

4.14.15

4.14.2

4.14.3

4.14.4

4.14.5

4.14.6

4.14.7

4.14.8

4.14.8.1

4.14.9

4.15.0

4.15.0.1

4.15.0.2

4.15.1

4.15.2

4.15.3

4.15.4

4.15.5

4.15.6

4.15.6.1

4.15.6.2

4.15.7

4.16.0

4.16.1

4.16.10

4.16.11

4.16.12

4.16.13

4.16.14

4.16.15

4.16.16

4.16.17

4.16.18

4.16.2

4.16.3

4.16.4

4.16.5

4.16.6

4.16.6.1

4.16.7

4.16.8

4.16.9

4.16.9.1

4.5.0-NA

4.8.10

4.8.11

4.8.6

4.8.7

4.8.8

4.8.9

5.*

5.0.0-NA

5.0.0-alpha.1

5.0.0-alpha.10

5.0.0-alpha.11

5.0.0-alpha.12

5.0.0-alpha.13

5.0.0-alpha.2

5.0.0-alpha.3

5.0.0-alpha.4

5.0.0-alpha.5

5.0.0-alpha.6

5.0.0-alpha.7

5.0.0-alpha.8

5.0.0-alpha.9

5.0.0-beta.1

5.0.0-beta.2

5.0.0-beta.3

5.0.0-beta.4

5.0.0-beta.5

5.0.0-beta.6

5.0.0-beta.7

5.0.0-beta.8

5.0.0-beta.9

5.0.0-rc1

5.2.0-beta.1

5.2.0-beta.2

5.2.0-beta.3

5.2.0-beta.4

5.2.0-beta.5

5.3.0

5.3.0-beta.1

5.3.0-beta.2

5.3.0.1

5.3.0.2

5.3.0.3

5.4.0

5.5.0

5.5.0.1

5.6.0

5.6.0.1

5.6.0.2

5.6.1

5.6.10

5.6.10.1

5.6.10.2

5.6.11

5.6.12

5.6.13

5.6.14

5.6.15

5.6.16

5.6.17

5.6.2

5.6.3

5.6.4

5.6.5

5.6.5.1

5.6.6

5.6.7

5.6.8

5.6.9

5.6.9.1

5.7.0

5.7.1

5.7.1.1

5.7.10

5.7.11

5.7.2

5.7.3

5.7.4

5.7.5

5.7.6

5.7.7

5.7.8

5.7.8.1

5.7.8.2

5.7.9

5.8.0

5.8.1

5.8.10

5.8.11

5.8.12

5.8.13

5.8.13.1

5.8.13.2

5.8.14

5.8.15

5.8.16

5.8.17

5.8.18

5.8.19

5.8.2

5.8.20

5.8.21

5.8.22

5.8.3

5.8.4

5.8.5

5.8.6

5.8.7

5.8.8

5.8.9

@craftcms/sass@1.*

@craftcms/sass@1.0.0

@craftcms/sass@1.0.1

@craftcms/webpack@0.*

@craftcms/webpack@0.0.1

@craftcms/webpack@0.2.0

@craftcms/webpack@0.3.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-27128.json"