{"action":"Upgrade craftcms/cms to 4.16.19 or later.","affected":[{"fixed":"4.16.19","introduced":"4.5.0-RC1"},{"fixed":"5.8.23","introduced":"5.0.0-RC1"}],"component":"craftcms/cms","cve_ids":["CVE-2026-27128"],"ecosystem":"Packagist","epss":0.00196,"exploited":false,"fixed_versions":["4.16.19","5.8.23"],"ghsa_id":"GHSA-6fx5-5cw5-4897","id":"tcs_01M5KEX0WG9W9H1A6V7KWPBB10","modified_at":"2026-02-24T16:20:27.514477Z","published_at":"2026-02-23T22:16:22Z","references":["https://osv.dev/vulnerability/GHSA-6fx5-5cw5-4897","https://github.com/craftcms/cms/security/advisories/GHSA-6fx5-5cw5-4897","https://nvd.nist.gov/vuln/detail/CVE-2026-27128","https://github.com/craftcms/cms/commit/3e4afe18279951c024c64896aa2b93cda6d95fdf","https://github.com/craftcms/cms"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"GHSA-6fx5-5cw5-4897","url":"https://osv.dev/vulnerability/GHSA-6fx5-5cw5-4897"},{"source":"nvd","source_id":"CVE-2026-27128","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-27128"}],"summary":"Craft CMS Race condition in Token Service potentially allows for token usage greater than the token limit"}