https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-28T20:52:11.805248+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-84801 fkie_cve-2026-84801 2026-09-28T20:52:11.982801+00:00

Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new password via actionSetPassword, which validates only the verification code without checking the caller's session, enabling complete control-panel takeover.

 https://vulnerability.circl.lu/vuln/ghsa-jqj3-2x8f-877r GHSA-jqj3-2x8f-877r 2026-09-28T20:52:11.982917+00:00

Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new password via actionSetPassword, which validates only the verification code without checking the caller's session, enabling complete control-panel takeover.