Craft CMS allows attackers to influence the preview token creation endpoint at /actions/preview/create-token because the action accepts a previewToken from the request and does not enforce CSRF protection. An authenticated editor with valid session cookies can be tricked into hitting this endpoint and will receive a preview token chosen by the attacker. Once the token is obtained, the attacker can use it in subsequent GET requests without authentication to view unpublished or preview content that the victim is authorized to see. This information disclosure exposes content that is not yet public, potentially compromising competitive advantage, privacy, or intellectual property.

Vendors: Craft CMS; product: Craft CMS; affected versions: any release earlier than 4.17.4 for the 4.x series or earlier than 5.9.7 for the 5.x series.

The CVSS score of 2.3 indicates low severity, and the EPSS score of less than 1% means exploitation probability is very low. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted request that forces a logged‑in editor to request a preview token with an attacker‑supplied value. No authentication is required to use the token, so the attacker can retrieve previewed or unpublished content belonging to the victim. The risk is mainly informational disclosure rather than denial of service or remote code execution, but exposure of internal content can have business and privacy consequences.