{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-07T00:26:23.529","vulnerabilities":[{"cve":{"id":"CVE-2026-27128","sourceIdentifier":"security-advisories@github.com","published":"2026-02-24T03:16:02.623","lastModified":"2026-02-27T20:06:52.050","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Craft is a content management system (CMS). In versions 4.5.0-RC1 through 4.16.18 and 5.0.0-RC1 through 5.8.22, a Time-of-Check-Time-of-Use (TOCTOU) race condition exists in Craft CMS’s token validation service for tokens that explicitly set a limited usage. The `getTokenRoute()` method reads a token’s usage count, checks if it’s within limits, then updates the database in separate non-atomic operations. By sending concurrent requests, an attacker can use a single-use impersonation token multiple times before the database update completes. To make this work, an attacker needs to obtain a valid user account impersonation URL with a non-expired token via some other means and exploit a race condition while bypassing any rate-limiting rules in place. For this to be a privilege escalation, the impersonation URL must include a token for a user account with more permissions than the current user. Versions 4.16.19 and 5.8.23 patch the issue."},{"lang":"es","value":"Craft es un sistema de gestión de contenidos (CMS). En las versiones 4.5.0-RC1 a 4.16.18 y 5.0.0-RC1 a 5.8.22, existe una condición de carrera Time-of-Check-Time-of-Use (TOCTOU) en el servicio de validación de tokens de Craft CMS para tokens que establecen explícitamente un uso limitado. El método `getTokenRoute()` lee el recuento de uso de un token, verifica si está dentro de los límites y luego actualiza la base de datos en operaciones no atómicas separadas. Al enviar solicitudes concurrentes, un atacante puede usar un token de suplantación de un solo uso varias veces antes de que se complete la actualización de la base de datos. Para que esto funcione, un atacante necesita obtener una URL de suplantación de cuenta de usuario válida con un token no caducado por otros medios y explotar una condición de carrera mientras elude cualquier regla de limitación de velocidad existente. Para que esto sea una escalada de privilegios, la URL de suplantación debe incluir un token para una cuenta de usuario con más permisos que el usuario actual. Las versiones 4.16.19 y 5.8.23 aplican un parche al problema."}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","baseScore":4.8,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":2.7}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-367"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*","versionStartExcluding":"4.5.0","versionEndExcluding":"4.16.19","matchCriteriaId":"FF425F3E-1E6A-4EE8-A1F8-9FA5399DE8DD"},{"vulnerable":true,"criteria":"cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*","versionStartExcluding":"5.0.0","versionEndExcluding":"5.8.23","matchCriteriaId":"A9572A70-5447-4861-9EC3-E51C5A7A9C56"},{"vulnerable":true,"criteria":"cpe:2.3:a:craftcms:craft_cms:4.5.0:-:*:*:*:*:*:*","matchCriteriaId":"48EC469C-4A9C-40A5-AD71-386D47255223"},{"vulnerable":true,"criteria":"cpe:2.3:a:craftcms:craft_cms:4.5.0:rc1:*:*:*:*:*:*","matchCriteriaId":"25BADF46-CF5B-448C-BE38-D297D7512534"},{"vulnerable":true,"criteria":"cpe:2.3:a:craftcms:craft_cms:5.0.0:-:*:*:*:*:*:*","matchCriteriaId":"1C7461CF-35AB-48E1-88B6-956DAE1D2AB4"},{"vulnerable":true,"criteria":"cpe:2.3:a:craftcms:craft_cms:5.0.0:rc1:*:*:*:*:*:*","matchCriteriaId":"8D8E02D1-601A-4E2B-B619-4775BFDB72D0"}]}]}],"references":[{"url":"https://github.com/craftcms/cms/commit/3e4afe18279951c024c64896aa2b93cda6d95fdf","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/craftcms/cms/security/advisories/GHSA-6fx5-5cw5-4897","source":"security-advisories@github.com","tags":["Third Party Advisory"]}]}}]}