CSRF Vulnerability in Craft CMS Affects Content Preview Functionality

CVE-2026-29113

What is CVE-2026-29113?

Craft CMS has a vulnerability associated with its preview token endpoint that allows attackers to leverage a Cross-Site Request Forgery (CSRF) flaw. Specifically, previous versions before 4.17.4 and 5.9.7 fail to enforce CSRF protection on the /actions/preview/create-token endpoint. This oversight permits a malicious actor to trick a logged-in editor into generating a preview token of their choice. Consequently, the attacker can access unpublished or preview content without requiring authentication, thereby compromising the security and confidentiality of the victim's content. It is crucial for users of Craft CMS to update to the latest versions to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References