2.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-29113

CVE-2026-29113: Craft has a potential information disclosure vulnerability in preview tokens

Craft is a content management system (CMS). Prior to 4.17.4 and 5.9.7, Craft CMS has a CSRF issue in the preview token endpoint at /actions/preview/create-token. The endpoint accepts an attacker-supplied previewToken. Because the action does not require POST and does not enforce a CSRF token, an attacker can force a logged-in victim editor to mint a preview token chosen by the attacker. That token can then be used by the attacker (without authentication) to access previewed/unpublished content tied to the victim’s authorized preview scope. This vulnerability is fixed in 4.17.4 and 5.9.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-29113

CVE-2026-29113:

2.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
craftcms/cms	composer	>= 4.0.0-RC1, < 4.17.3	4.17.4
craftcms/cms	composer	>= 5.0.0-RC1, < 5.9.6	5.9.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a CSRF issue in the preview token creation endpoint, /actions/preview/create-token, which is handled by the actionCreateToken method in craft\controllers\PreviewController. The vulnerability existed because the endpoint accepted a previewToken parameter directly from a GET request without validating its origin or integrity. An attacker could pre-determine a token, embed it in a URL, and trick a logged-in administrator into clicking it. This would cause the application to create a valid preview session using the attacker's token.

The patch mitigates this by introducing a token hashing mechanism. The ElementsController::actionEdit method now generates a random token and a corresponding secure hash (hashedPreviewToken). This hashed token is passed to the frontend. The frontend JavaScript (ElementEditor.js) then sends this hashed token to the PreviewController::actionCreateToken method. The actionCreateToken method was modified to validate the incoming token using Craft::$app->getSecurity()->validateData(), which ensures the token was generated by the application and not by an attacker. The key vulnerable function is craft\controllers\PreviewController::actionCreateToken as it was the function that improperly trusted user-supplied input, leading to the information disclosure.

Vulnerable functions

craft\controllers\PreviewController::actionCreateToken

src/controllers/PreviewController.php

This function handles the `/actions/preview/create-token` endpoint. Before the patch, it accepted a `previewToken` from a GET request without any validation. This allowed an attacker to perform a Cross-Site Request Forgery (CSRF) attack by crafting a URL with a known token. When a logged-in victim visited this URL, the attacker's token would be associated with the victim's authenticated session, granting the attacker unauthorized access to preview content.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.