CVE-2026-84795 in Craft CMS
Summary
by MITRE • 09/02/2026
Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification are configured.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in Craft CMS versions prior to 5.10.11 represents a critical authentication bypass resulting from insufficient validation of administrative privilege flags during the user account creation process. This flaw specifically targets the logic governing how new accounts inherit or retain role attributes, particularly when interacting with existing deactivated administrator accounts. Under normal operational parameters, an administrator account that has been deactivated should no longer possess active privileges, and any attempt to create a new account using its associated email address should result in either a rejection of the duplicate entry or the creation of a standard user account without elevated permissions. However, due to the failure to properly validate the admin flag during this registration phase, the system erroneously persists the administrative status from the deactivated source account to the newly created active account. This behavior indicates a fundamental breakdown in state management and privilege assignment logic within the application's core authentication module.
From a technical perspective, the root cause lies in the lack of sanitization or reset mechanisms for role-based access control attributes when processing registration requests linked to previously existing user records. When public registration is enabled and email verification is disabled, as configured by many administrators seeking convenience over strict security postures, the application accepts input data without sufficient scrutiny regarding the origin of the account metadata. The system fails to distinguish between a fresh identity creation and an inheritance scenario where sensitive privilege flags are carried over from inactive records. This allows an attacker who possesses knowledge of a deactivated administrator's email address to exploit this logic gap by registering under that same identifier, thereby automatically inheriting full administrative control over the CMS instance without needing to bypass traditional login mechanisms or discover valid credentials for active accounts.
The operational impact of this vulnerability is severe, as it grants unauthorized users complete control over the content management system and potentially the underlying server infrastructure depending on how Craft CMS is deployed. An attacker leveraging this flaw can modify site configurations, inject malicious code into templates or plugins, access sensitive user data including personally identifiable information stored within the database, and escalate privileges to execute arbitrary commands if further exploitation vectors are present in associated modules. This effectively compromises the confidentiality, integrity, and availability of the web application environment. The severity is amplified by the fact that it does not require prior authentication for the attacker but relies on a specific configuration state where public registration is allowed and email verification is turned off, which remains a common setup for many community-driven or open-source projects hosted on Craft CMS.
This vulnerability aligns with CWE-284 Improper Access Control, specifically reflecting failures in enforcing proper authorization checks during account lifecycle management events such as creation and activation. It also maps to MITRE ATT&CK technique T1078 Valid Accounts, where adversaries use legitimate credentials or accounts that have been compromised or manipulated to gain initial access. In this context, the manipulation involves exploiting a logic flaw to transform an inactive administrative identity into an active privileged one without detection by standard security controls like multi-factor authentication or password complexity requirements, since those mechanisms are bypassed entirely during the registration phase rather than at login time.
Mitigation strategies must focus on immediate patching and configuration hardening. Administrators running Craft CMS versions earlier than 5.10.11 should upgrade to the latest stable release immediately to apply the vendor-provided fix that corrects the privilege inheritance logic. In environments where upgrading is not instantly feasible, it is critical to disable public registration entirely or enforce strict email verification processes for all new accounts. Additionally, administrators should review existing user roles and ensure that deactivated administrative accounts are fully purged of any residual privileges before being archived or deleted from the database. Regular audits of user permissions and disabling unnecessary features like open registration in production environments significantly reduce the attack surface available to potential adversaries seeking to exploit such logic flaws.