CVE-2026-84801 in Craft CMS
Summary
by MITRE • 09/02/2026
Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new password via actionSetPassword, which validates only the verification code without checking the caller's session, enabling complete control-panel takeover.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in Craft CMS versions prior to 5.10.11 represents a critical authentication bypass flaw rooted in insufficient access control validation within the password reset functionality. Specifically, the actionGetPasswordResetUrl endpoint fails to verify whether the requesting user possesses administrative privileges before generating a password reset token for an administrator account. This architectural oversight allows any authenticated user who holds the administrateUsers permission, regardless of their actual role or privilege level, to initiate a password reset process targeting high-privilege accounts. By exploiting this logic error, attackers can generate valid, time-sensitive URLs designed specifically for administrative users without requiring knowledge of the admin's email address or other identifying information beyond what is available through standard user enumeration techniques.
The operational impact of this vulnerability extends far beyond simple credential theft, as it facilitates a complete takeover of the control panel and underlying system administration capabilities. Once an attacker generates a password reset URL for an administrator account, they can direct that link to themselves or use it programmatically via the actionSetPassword endpoint. Crucially, the validation mechanism within actionSetPassword relies solely on the correctness of the verification code embedded in the reset token rather than checking the current session state or verifying that the request originates from a legitimate administrative context. This design flaw means that possession of the valid reset link is sufficient to authenticate and change credentials, effectively bypassing multi-factor authentication protections if they are not strictly enforced at the password set stage, and granting the attacker full administrative access to the application environment.
From a technical classification perspective, this vulnerability aligns with CWE-284 Improper Access Control, as it involves failing to enforce proper restrictions on privileged actions for unauthorized actors. Furthermore, the exploitation path maps directly to MITRE ATT&CK technique T1078 Valid Accounts, specifically within the context of account manipulation and privilege escalation. The attacker leverages valid credentials with limited permissions to escalate privileges by manipulating authentication mechanisms, thereby gaining higher-level access than originally intended. This scenario highlights a common pitfall in web application development where permission checks are applied inconsistently across different endpoints or functions that interact with sensitive user data.
Mitigation strategies must prioritize immediate patching of the Craft CMS installation to version 5.10.11 or later, which addresses these validation gaps by enforcing strict administrative role verification during password reset generation and ensuring session integrity is maintained throughout the credential change process. In environments where upgrading is not immediately feasible, administrators should review user permissions carefully, restricting the administrateUsers permission only to users who genuinely require it for operational purposes. Additionally, implementing robust monitoring for unusual patterns in password reset requests can help detect exploitation attempts early. Security teams should also ensure that multi-factor authentication is enabled and strictly enforced at all stages of administrative access, including during credential resets, to add a layer of defense-in-depth against such bypass techniques.