CVE-2026-84801 Details
Description
Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new password via actionSetPassword, which validates only the verification code without checking the caller's session, enabling complete control-panel takeover.
A vulnerability exists in Craft CMS versions 5.0.0-RC1 prior to 5.10.11, where the actionGetPasswordResetUrl endpoint does not properly validate admin status. This flaw allows non-admin users with the administrateUsers permission to generate password reset URLs for admin accounts. Once a reset URL is created, the attacker can use the actionSetPassword endpoint to change the password for the admin account, as this action only verifies the provided code without checking the user's session. This oversight enables a complete takeover of the admin's control panel.
Users can update to Craft CMS version 5.10.11 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 2, 2026CISA-ADP
Assessed Sep 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/craftcms/cms/security/advisories/GHSA-6qw4-cjqw-fj72 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/craft-cms-5.0.0-rc1-before-5.10.11-authentication-bypass-via-administrateusers | [email protected] |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Craft CMS | >= 5.0.0-RC1, < 5.10.11 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 2, 2026 | CVE Modified | CISA-ADP |
| Sep 2, 2026 | New CVE Received | [email protected] |