CVE-2026-79989 Details
Description
The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission (which doesn’t allow changing others’ passwords) and lacks Administrate users permission (which is required to change others’ passwords).
A vulnerability in Craft CMS versions 5.0.0-RC1 prior to 5.10.8 allows authenticated users to change their passwords without providing the current password or having an elevated session. Additionally, users with 'Edit users' permission can change the passwords of other users, including administrators. This issue arises because the 'UserPasswordValidator' only applies a safe validator to the 'newPassword' field, allowing it to be mass-assigned during the general element save process. As a result, the dedicated 'users/set-password' action, which requires an elevated session, is bypassed. An attacker with any authenticated session can exploit this vulnerability to change their own password and potentially take over administrator accounts.
Users can update to Craft CMS version 5.10.8 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 2, 2026CISA-ADP
Assessed Sep 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/advisories/GHSA-p8x7-9vfw-p7vc | Hackrate | AdvisoryRemedyVendor |
| https://github.com/craftcms/cms | Hackrate | Source CodeVendor |
| https://github.com/craftcms/cms/releases/tag/5.10.8 | Hackrate | Release NotesVendor |
| https://www.hckrt.com/hacktivity/HCKRT-ZDSZJH | Hackrate | Technical Description |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | Hackrate |
Affected Products
| Product | Versions |
|---|---|
| Craft CMS | >= 5.0.0-RC1, < 5.10.8 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 2, 2026 | CVE Modified | CISA-ADP |
| Sep 2, 2026 | New CVE Received | Hackrate |