CVE-2026-29113 Craft has a potential information disclosure vulnerability in preview tokens

Craft is a content management system CMS. Prior to 4.17.3 and 5.9.7, Craft CMS has a CSRF issue in the preview token endpoint at /actions/preview/create-token. The endpoint accepts an attacker-supplied previewToken. Because the action does not require POST and does not enforce a CSRF token, an...

PT-2026-24403

Name of the Vulnerable Software and Affected Versions Craft versions prior to 4.17.4 Craft versions prior to 5.9.7 Description Craft CMS has a Cross-Site Request Forgery CSRF issue in the preview token endpoint. The endpoint, located at /actions/preview/create-token, accepts an attacker-supplied...