Craft CMS permits a low‑privilege or unauthenticated user who receives a shared URL to elevate their privileges to administrator by calling the UsersController->actionImpersonateWithToken() method. The vulnerability is an instance of arbitrary account impersonation (CWE‑863) that results in full administrative access without the need for valid credentials.

Affected Craft CMS releases include all versions from 4.0.0‑RC1 up to but not including 4.17.6, as well as from 5.0.0‑RC1 up to but not including 5.9.12. The patch is incorporated in 4.17.6 and 5.9.12 respectively.

The CVSS score of 7.7 indicates a high impact, while the EPSS score of <1% suggests the likelihood of exploitation is low. The issue is not listed in CISA’s KEV catalog. Attackers can exploit this remotely by providing a crafted link that targets the impersonate endpoint, requiring only low‑privilege or unauthenticated access to trigger the privilege escalation.