Craft CMS contains a CSRF vulnerability in the preview token endpoint (/actions/preview/create-token). The action allows an attacker to supply a previewToken in a request without requiring a POST method or a CSRF token. A logged‑in editor who follows a crafted link may generate a preview token chosen by the attacker. The attacker can then use that token in unauthenticated GET requests to view previewed or unpublished content that the victim can otherwise see. The primary consequence is the disclosure of content that has not yet been published to the public.

The vulnerability affects Craft CMS versions prior to 4.17.3 in the 4.x series and earlier than 5.9.7 in the 5.x series. All other versions that have applied the 4.17.3 or 5.9.7 patches are considered fixed.

The CVSS score of 2.3 indicates low severity and the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a CSRF attack where a victim editor is tricked into sending a crafted request that supplies an attacker‑controlled previewToken. No authentication is required to use the token, so the attacker can retrieve the previewed or unpublished content tied to the victim’s authorized preview scope.