Remote Code Execution Vulnerability in Craft CMS Administrators
CVE-2026-32264
8.6HIGH
What is CVE-2026-32264?
Craft CMS, a popular content management system, is vulnerable to a behavior injection remote code execution (RCE) issue affecting both the ElementIndexesController and FieldsController. This vulnerability requires administrator permissions and the allowAdminChanges setting to be enabled, making it critical for administrators to update to the patched versions (4.17.5 and 5.9.11) to ensure system security. Failure to apply the update could expose the application to unauthorized code execution risks.
Affected Version(s)
cms >= 4.0.0-RC1, < 4.17.5 < 4.0.0-RC1, 4.17.5
cms >= 5.0.0-RC1, < 5.9.11 < 5.0.0-RC1, 5.9.11