Craft CMS contains a Time‑of‑Check Time‑of‑Use race condition in its token validation service. The code reads a token’s usage count, verifies it is within allowed limits, and then updates the database in separate non‑atomic operations. An attacker can issue multiple concurrent requests using the same limited‑usage token before the usage count is incremented, allowing the token to be used more times than intended. If the token belongs to a user with higher privileges than the current user, this can elevate the attacker’s access level. The weakness matches CWE‑367.

Vulnerable Craft CMS releases include version 4.5.0‑RC1 through 4.16.18 and 5.0.0‑RC1 through 5.8.22. The secure releases that fix the race condition are Craft CMS 4.16.19 and 5.8.23. Organisations using any of these versions should verify whether their deployment is affected.

The CVSS base score is 6.9, indicating a moderate severity. The EPSS score is below 1 %, implying a low probability of exploitation at any given time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an existing, valid impersonation URL with a non‑expired token for a target user, as well as the ability to send concurrent requests and bypass any rate‑limiting controls. Once those conditions are met, the race condition can be triggered to gain elevated privileges.