CVE-2026-29113: Craft CMS CSRF Vulnerability

CVE-2026-29113 Overview

CVE-2026-29113 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Craft CMS, a popular content management system. The vulnerability exists in the preview token endpoint at /actions/preview/create-token, which accepts an attacker-supplied previewToken without enforcing CSRF protections or requiring POST requests. This allows an attacker to force a logged-in victim (such as a content editor) to mint a preview token chosen by the attacker. The attacker can then use this token without authentication to access previewed or unpublished content tied to the victim's authorized preview scope.

Critical Impact
Attackers can gain unauthorized access to unpublished content and draft entries by exploiting CSRF to hijack preview tokens from authenticated CMS editors.

Affected Products

Craft CMS versions prior to 4.17.4
Craft CMS versions prior to 5.9.7

Discovery Timeline

2026-03-10 - CVE CVE-2026-29113 published to NVD
2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-29113

Vulnerability Analysis

This CSRF vulnerability stems from insufficient request validation in Craft CMS's preview functionality. The /actions/preview/create-token endpoint is designed to generate preview tokens that allow users to view unpublished or draft content. However, the endpoint fails to implement proper CSRF protections—it does not require a POST request method and does not validate CSRF tokens.

This architectural flaw means that when a logged-in Craft CMS editor visits a malicious webpage or clicks a crafted link, the attacker can trigger a request to the vulnerable endpoint on behalf of the victim. The attacker can specify an arbitrary previewToken value in this forged request. Once the victim's browser executes this request (using the victim's active session), the attacker-chosen token becomes valid within the victim's preview scope.

The attacker can then use this known token value to access previewed content without needing to authenticate, effectively bypassing authorization controls for draft and unpublished content.

Root Cause

The root cause is the absence of CSRF protection mechanisms on the preview token creation endpoint. The endpoint:

Does not enforce the HTTP POST method, allowing GET-based CSRF attacks
Does not require or validate a CSRF token to confirm request legitimacy
Accepts user-supplied previewToken values without binding them to a proper authorization flow

This combination allows cross-origin requests initiated by malicious sites to successfully create preview tokens in the context of an authenticated user's session.

Attack Vector

The attack requires a network-based vector where an attacker must convince a logged-in Craft CMS editor to visit a malicious webpage or click a crafted link. The attack flow proceeds as follows:

The attacker prepares a malicious webpage containing a forged request to /actions/preview/create-token with a previewToken value the attacker controls
A logged-in Craft CMS editor visits the malicious page (through phishing, social engineering, or embedding in an otherwise legitimate site)
The victim's browser sends the forged request to the Craft CMS instance with the victim's session cookies
The Craft CMS server mints the attacker-specified preview token under the victim's preview scope
The attacker uses this token to access unpublished or draft content without authentication

Since no code examples are available from verified sources, technical implementation details can be found in the GitHub Security Advisory and the associated commit fix.

Detection Methods for CVE-2026-29113

Indicators of Compromise

Unusual or unexpected requests to /actions/preview/create-token endpoint, especially from external referrers
Preview token generation events in CMS logs where the originating page or referrer is from an external domain
Access to preview content using tokens that were not legitimately generated by the expected user

Detection Strategies

Monitor web server access logs for requests to /actions/preview/create-token with suspicious referrer headers or lacking proper CSRF tokens
Implement web application firewall (WAF) rules to flag GET requests to sensitive action endpoints
Audit preview token usage patterns to identify tokens being accessed from IP addresses different from those that created them

Monitoring Recommendations

Enable detailed logging for the Craft CMS control panel and preview functionality
Set up alerts for cross-origin requests to administrative or action endpoints
Regularly review access logs for patterns consistent with CSRF exploitation attempts

How to Mitigate CVE-2026-29113

Immediate Actions Required

Upgrade Craft CMS to version 4.17.4 or later for the 4.x branch
Upgrade Craft CMS to version 5.9.7 or later for the 5.x branch
Audit preview token activity to identify any suspicious token creation or usage patterns

Patch Information

Craft CMS has released patched versions that address this CSRF vulnerability. The fix is available in versions 4.17.4 and 5.9.7. The security patch adds proper CSRF token validation and enforces appropriate HTTP method requirements on the preview token endpoint. Technical details of the fix can be reviewed in the GitHub commit.

Workarounds

Implement network-level access controls to restrict access to the Craft CMS control panel to trusted IP ranges
Deploy a web application firewall (WAF) with CSRF protection rules to block suspicious cross-origin requests to action endpoints
Educate CMS editors about phishing risks and the importance of not clicking unknown links while logged into the CMS
Consider implementing additional session validation or multi-factor authentication for sensitive CMS operations

bash

# Upgrade Craft CMS via Composer
composer require craftcms/cms:^4.17.4
# or for version 5.x
composer require craftcms/cms:^5.9.7