CVE-2026-84801

Craft CMS versions before 5.10.11 contain a missing-authorization flaw (CWE-862) in its user-management endpoints: the actionGetPasswordResetUrl action does not verify that the requesting user is an administrator, so any authenticated non-admin user holding the 'administrate users' permission can generate a valid password-reset URL for any administrator account. The companion actionSetPassword endpoint then validates only the reset verification code and does not check the caller's session, allowing the attacker to set a new password for that administrator. As a result, a permitted low-privilege user — or anyone who compromises such an account — can take over an administrator account and gain full control of the Craft control panel. All Craft CMS installations running versions before 5.10.11 are affected, though in practice only sites that have delegated the 'administrate users' permission to non-admin accounts are exploitable. No public proof-of-concept is known, the flaw is not listed in CISA KEV, and EPSS puts the 30-day exploitation probability at about 0.2%, so no in-the-wild exploitation is currently confirmed.

What to do: Upgrade Craft CMS to 5.10.11 or later as soon as possible. As an interim mitigation, revoke the 'administrate users' permission from non-administrator accounts, since that permission is the prerequisite for triggering the flaw. Sites should also review control-panel logs for password-reset URLs generated for administrator accounts or unexpected admin password changes.