CVE-2026-84795 — Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance
Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactiv…
Published: 2026-09-02 · CVSS: 9.2 · CVSS 4.0
Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification are configured.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7