CVE-2026-84795

Craft CMS before 5.10.11 contains an improper privilege management flaw (CWE-269) in which the admin flag of deactivated administrator accounts persists during user registration. When public registration is enabled and email verification is disabled, an unauthenticated attacker can register an account using the email address of a deactivated admin and inherit full administrator privileges. Successful exploitation grants complete control of the CMS, consistent with the high confidentiality, integrity, and availability impacts in the 9.2 (critical) CVSS 4.0 score. Only deployments running affected versions with public registration, disabled email verification, and at least one deactivated admin account are exploitable. No in-the-wild exploitation, public proof-of-concept, or KEV listing is currently known; EPSS estimates a 0.3% probability of exploitation in the next 30 days.

What to do: Upgrade Craft CMS to 5.10.11 or later. If upgrading is deferred, disable public user registration or re-enable email verification on registration, and delete or rename deactivated admin accounts so their email addresses cannot be claimed. Also audit recently self-registered users for unexpectedly inherited admin privileges.