CVE-2026-84801 — Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers
Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint pas…
Published: 2026-09-02 · CVSS: 8.7 · CVSS 4.0
Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new password via actionSetPassword, which validates only the verification code without checking the caller's session, enabling complete control-panel takeover.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7