CVE-2026-27128 Craft CMS's race condition in Token Service potentially allows for token usage greater than the token limit
Attackers can exploit a race condition in Craft CMS token validation to reuse limited-use impersonation tokens, potentially escalating privileges.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-27128?
CVE-2026-27128 is a medium-severity vulnerability in Craftcms Craft Cms, published on 24 Feb 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a Time-of-Check-Time-of-Use (TOCTOU) race condition exists in Craft CMS’s token validation service for tokens that explicitly set a limited usage. The `getTokenRoute()` method reads a token’s usage count, checks if it’s within limits, then updates the database in separate non-atomic operations. By sending concurrent requests, an attacker can use a single-use impersonation token multiple times before the database update completes. To make this work, an attacker needs to obtain a valid user account impersonation URL with a non-expired token via some other means and exploit a race condition while bypassing any rate-limiting rules in place. For this to be a privilege escalation, the impersonation URL must include a token for a user account with more permissions than the current user. Versions 4.16.19 and 5.8.23 patch the issue.
Weakness: CWE-367
Which versions are affected by CVE-2026-27128?
4 open source packages ship an affected version, including craftcms/cms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
craftcms/cms Packagist | From 4.5.0-RC1 | 4.16.19 |
craftcms/cms Packagist | From 4.5.0-RC1 | 4.16.19 |
craftcms/cms Packagist | From 5.0.0-RC1 | 5.8.23 |
craftcms/cms Packagist | From 5.0.0-RC1 | 5.8.23 |
Products include Craftcms Craft Cms.
How do I fix CVE-2026-27128?
Upgrade craftcms/cms to a fixed version for your release line: 4.16.19 or 5.8.23.
Is CVE-2026-27128 being exploited?
There is no known exploitation of CVE-2026-27128 in the wild and no public exploit code.
Other vulnerabilities in Craftcms Craft Cms
Sources
Also known as GHSA-6fx5-5cw5-4897.