Vulnerability-Lookup

CVE-2026-79989 (GCVE-0-2026-79989)

Vulnerability from cvelistv5 – Published: 2026-09-02 14:11 – Updated: 2026-09-02 17:51

Title

Arbitrary user password reset leading to administrator account takeover

Summary

The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission (which doesn’t allow changing others’ passwords) and lacks Administrate users permission (which is required to change others’ passwords).

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-02 17:51 UTC

CWE

CWE-285 - Improper Authorization

Assigner

Hackrate icscert root

References

4 references

URL	Tags
https://www.hckrt.com/hacktivity/HCKRT-ZDSZJH	third-party-advisorytechnical-descriptionmitigation
https://github.com/craftcms/cms/releases/tag/5.10.8	release-notes
https://github.com/craftcms/cms	product
https://github.com/advisories/GHSA-p8x7-9vfw-p7vc	third-party-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
craftcms	cms	Affected: 5.0.0-RC1 , < 5.10.8 (semver) cpe:2.3:a:craftcms:cms::::::::

Credits

Mohammed Hesham (@he4am) Hackrate

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-79989",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-02T17:51:36.553736Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-02T17:51:42.963Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "packageName": "craftcms/cms",
          "product": "cms",
          "vendor": "craftcms",
          "versions": [
            {
              "lessThan": "5.10.8",
              "status": "affected",
              "version": "5.0.0-RC1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.8",
                  "versionStartIncluding": "5.0.0-rc1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Mohammed Hesham (@he4am)"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "Hackrate"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users\u2019 passwords if the attacker\u2019s account has\u0026nbsp;\u003ccode\u003eEdit users\u003c/code\u003e\u0026nbsp;permission (which doesn\u2019t allow changing others\u2019 passwords) and lacks\u0026nbsp;\u003ccode\u003eAdministrate users\u003c/code\u003e\u0026nbsp;permission (which is required to change others\u2019 passwords).\u003cbr\u003e"
            }
          ],
          "value": "The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users\u2019 passwords if the attacker\u2019s account has\u00a0Edit users\u00a0permission (which doesn\u2019t allow changing others\u2019 passwords) and lacks\u00a0Administrate users\u00a0permission (which is required to change others\u2019 passwords)."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-02T14:11:02.784Z",
        "orgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
        "shortName": "Hackrate"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory",
            "technical-description",
            "mitigation"
          ],
          "url": "https://www.hckrt.com/hacktivity/HCKRT-ZDSZJH"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/craftcms/cms/releases/tag/5.10.8"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/craftcms/cms"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/advisories/GHSA-p8x7-9vfw-p7vc"
        }
      ],
      "source": {
        "advisory": "GHSA-p8x7-9vfw-p7vc",
        "discovery": "UNKNOWN"
      },
      "title": "Arbitrary user password reset leading to administrator account takeover",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
    "assignerShortName": "Hackrate",
    "cveId": "CVE-2026-79989",
    "datePublished": "2026-09-02T14:11:02.784Z",
    "dateReserved": "2026-08-25T16:39:03.171Z",
    "dateUpdated": "2026-09-02T17:51:42.963Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-79989",
      "date": "2026-09-03",
      "epss": "0.00313",
      "percentile": "0.23733"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-79989\",\"sourceIdentifier\":\"7004884b-51e2-48e8-b4a2-5ca29e80453e\",\"published\":\"2026-09-02T15:17:42.297\",\"lastModified\":\"2026-09-02T18:21:25.740\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users\u2019 passwords if the attacker\u2019s account has\u00a0Edit users\u00a0permission (which doesn\u2019t allow changing others\u2019 passwords) and lacks\u00a0Administrate users\u00a0permission (which is required to change others\u2019 passwords).\"}],\"affected\":[{\"source\":\"7004884b-51e2-48e8-b4a2-5ca29e80453e\",\"affectedData\":[{\"vendor\":\"craftcms\",\"product\":\"cms\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://packagist.org\",\"packageName\":\"craftcms/cms\",\"versions\":[{\"version\":\"5.0.0-RC1\",\"lessThan\":\"5.10.8\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"7004884b-51e2-48e8-b4a2-5ca29e80453e\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-02T17:51:36.553736Z\",\"id\":\"CVE-2026-79989\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"7004884b-51e2-48e8-b4a2-5ca29e80453e\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-285\"}]}],\"references\":[{\"url\":\"https://github.com/advisories/GHSA-p8x7-9vfw-p7vc\",\"source\":\"7004884b-51e2-48e8-b4a2-5ca29e80453e\"},{\"url\":\"https://github.com/craftcms/cms\",\"source\":\"7004884b-51e2-48e8-b4a2-5ca29e80453e\"},{\"url\":\"https://github.com/craftcms/cms/releases/tag/5.10.8\",\"source\":\"7004884b-51e2-48e8-b4a2-5ca29e80453e\"},{\"url\":\"https://www.hckrt.com/hacktivity/HCKRT-ZDSZJH\",\"source\":\"7004884b-51e2-48e8-b4a2-5ca29e80453e\"}]}}"
  }
}

FKIE_CVE-2026-79989

Vulnerability from fkie_nvd - Published: 2026-09-02 15:17 - Updated: 2026-09-02 18:21

Severity

8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	7004884b-51e2-48e8-b4a2-5ca29e80453e	https://github.com/advisories/GHSA-p8x7-9vfw-p7vc
	7004884b-51e2-48e8-b4a2-5ca29e80453e	https://github.com/craftcms/cms
	7004884b-51e2-48e8-b4a2-5ca29e80453e	https://github.com/craftcms/cms/releases/tag/5.10.8
	7004884b-51e2-48e8-b4a2-5ca29e80453e	https://www.hckrt.com/hacktivity/HCKRT-ZDSZJH

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "packageName": "craftcms/cms",
          "product": "cms",
          "vendor": "craftcms",
          "versions": [
            {
              "lessThan": "5.10.8",
              "status": "affected",
              "version": "5.0.0-RC1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users\u2019 passwords if the attacker\u2019s account has\u00a0Edit users\u00a0permission (which doesn\u2019t allow changing others\u2019 passwords) and lacks\u00a0Administrate users\u00a0permission (which is required to change others\u2019 passwords)."
    }
  ],
  "id": "CVE-2026-79989",
  "lastModified": "2026-09-02T18:21:25.740",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-79989",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-02T17:51:36.553736Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-02T15:17:42.297",
  "references": [
    {
      "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
      "url": "https://github.com/advisories/GHSA-p8x7-9vfw-p7vc"
    },
    {
      "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
      "url": "https://github.com/craftcms/cms"
    },
    {
      "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
      "url": "https://github.com/craftcms/cms/releases/tag/5.10.8"
    },
    {
      "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
      "url": "https://www.hckrt.com/hacktivity/HCKRT-ZDSZJH"
    }
  ],
  "sourceIdentifier": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ],
      "source": "7004884b-51e2-48e8-b4a2-5ca29e80453e",
      "type": "Secondary"
    }
  ]
}

GHSA-37QX-6JV9-FFQV

Vulnerability from github – Published: 2026-09-02 15:34 – Updated: 2026-09-02 15:34

Details

Severity

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-79989"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-02T15:17:42Z",
    "severity": "HIGH"
  },
  "details": "The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users\u2019 passwords if the attacker\u2019s account has\u00a0Edit users\u00a0permission (which doesn\u2019t allow changing others\u2019 passwords) and lacks\u00a0Administrate users\u00a0permission (which is required to change others\u2019 passwords).",
  "id": "GHSA-37qx-6jv9-ffqv",
  "modified": "2026-09-02T15:34:50Z",
  "published": "2026-09-02T15:34:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-79989"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-p8x7-9vfw-p7vc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/releases/tag/5.10.8"
    },
    {
      "type": "WEB",
      "url": "https://www.hckrt.com/hacktivity/HCKRT-ZDSZJH"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-P8X7-9VFW-P7VC

Vulnerability from github – Published: 2026-08-06 21:04 – Updated: 2026-08-06 21:04

Summary

Craft CMS: Arbitrary user password reset leading to administrator account takeover

Details

The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has edit users permission (which doesn’t allow changing others’ passwords) and lacks Administrate users permission (which is required to change others’ passwords).

The vulnerability exists in the elements/save action when saving a User element. The UserPasswordValidator applies only a safe validator to the newPassword field without an on scenario restriction. This makes newPassword mass-assignable during the generic element save flow, completely bypassing the dedicated users/set-password action that enforces elevated session verification.

An attacker with any authenticated session (whether it’s hijacked or a normal / low-privileged user) can change their own password, and potentially take over administrator accounts.

Required Permissions

Access the control panel
Edit users (needed for the account takeover attack scenario)

Impact

Any authenticated user can change their own password without providing their current password.
Users with Edit users permission can change any user’s password, including administrators.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "craftcms/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-RC1"
            },
            {
              "fixed": "5.10.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-285"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-06T21:04:11Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users\u2019 passwords if the attacker\u2019s account has `edit users` permission (which doesn\u2019t allow changing others\u2019 passwords) and lacks `Administrate users` permission (which is required to change others\u2019 passwords).\n\nThe vulnerability exists in the `elements/save` action when saving a User element. The `UserPasswordValidator` applies only a `safe` validator to the `newPassword` field without an `on` scenario restriction. This makes `newPassword` mass-assignable during the generic element save flow, completely bypassing the dedicated `users/set-password` action that enforces elevated session verification.\n\nAn attacker with any authenticated session (whether it\u2019s hijacked or a normal / low-privileged user) can change their own password, and potentially take over administrator accounts.\n\n## Required Permissions\n- Access the control panel\n- Edit users (needed for the account takeover attack scenario)\n\n## Impact\n- Any authenticated user can change their own password without providing their current password.\n- Users with Edit users permission can change any user\u2019s password, including administrators.",
  "id": "GHSA-p8x7-9vfw-p7vc",
  "modified": "2026-08-06T21:04:11Z",
  "published": "2026-08-06T21:04:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/security/advisories/GHSA-p8x7-9vfw-p7vc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/commit/cbdf45fbd3ab548b147d7de375f6f6f580b7c294"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/craftcms/cms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/craftcms/cms/releases/tag/5.10.8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Craft CMS: Arbitrary user password reset leading to administrator account takeover"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-79989 (GCVE-0-2026-79989)

FKIE_CVE-2026-79989

GHSA-37QX-6JV9-FFQV

GHSA-P8X7-9VFW-P7VC

Required Permissions

Impact

Tags

Sightings

Nomenclature