CVE-2026-86731

CVE-2026-86731 is a missing-authorization flaw (CWE-862) in Craft CMS 5.0.0-RC1 through 5.10.11, where the control panel's users/activate-user action (UsersController::actionActivateUser) requires the administrateUsers permission but, unlike the mirror action actionDeactivateUser, does not call requireAdmin() when the target user is an administrator. As a result, an authenticated, non-administrator user who holds the administrateUsers permission can activate a pending or deliberately deactivated administrator account. Combined with the ability to reset that account's password, this allows the user to take over an administrator account and escalate their privileges in the CMS. Any Craft CMS 5 deployment in which non-admin users are granted the administrateUsers permission is affected, and the issue is fixed in Craft CMS 5.10.12. There is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns roughly a 0.2% probability of exploitation within 30 days.

What to do: Upgrade Craft CMS 5.x deployments to version 5.10.12 or later. Until patched, revoke the administrateUsers permission from non-admin users and audit for pending or deactivated administrator accounts that could be activated and reset. Review recent activation and password-reset activity on administrator accounts for signs of takeover.