Time-of-Check-Time-of-Use Race Condition in Craft CMS by Craft

CVE-2026-27128

What is CVE-2026-27128?

Craft CMS versions from 4.5.0-RC1 to 4.16.18 and 5.0.0-RC1 to 5.8.22 are affected by a Time-of-Check-Time-of-Use (TOCTOU) race condition in its token validation service. This flaw arises due to non-atomic database operations during token usage count checks. An attacker can exploit this by sending simultaneous requests, allowing them to reuse a single-use impersonation token multiple times before the system updates its usage count. Attackers must first obtain a valid user account's impersonation URL and a non-expired token, enabling them to bypass any existing rate limits. For privilege escalation, the token must correspond to an account with elevated permissions compared to the current user. The issue is addressed in versions 4.16.19 and 5.8.23.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References