CVE-2026-86731 in Craft CMS
Summary
by MITRE • 09/08/2026
Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser (the users/activate-user action). While the action requires the administrateUsers permission, it does not call requireAdmin() when the targeted user is an administrator, unlike the mirror action actionDeactivateUser. As a result, an authenticated control panel user who is not an administrator but holds the administrateUsers permission can activate a pending or deliberately deactivated administrator account, which can lead to permission escalation when combined with resetting that account's password. The issue is fixed in Craft CMS 5.10.12.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified in Craft CMS versions 5.0.0-RC1 through 5.10.11 represents a critical authorization bypass within the user management subsystem, specifically targeting the UsersController::actionActivateUser endpoint. This function is designed to activate pending or deactivated user accounts, thereby granting them full access to their respective profiles and permissions. While the action correctly enforces that the requesting authenticated control panel user must possess the administrateUsers permission, it fails to implement a secondary guard for administrative privileges when the target of this operation is an administrator account. This inconsistency creates a significant security gap where lower-privileged users with specific management rights can inadvertently or maliciously elevate their standing by activating dormant admin accounts.
The root cause lies in the asymmetry between two related functions within the same controller class. The actionDeactivateUser method, which handles the deactivation of user accounts, correctly invokes requireAdmin() to ensure that only true administrators can perform this operation on any account type, including other administrators. In contrast, actionActivateUser lacks this equivalent check for administrator targets. This oversight allows an authenticated non-administrator user who holds the administrateUsers permission to bypass standard privilege escalation controls. By activating a pending or deliberately deactivated administrator account, such a user gains the ability to interact with that high-privilege identity within the system context.
The operational impact of this flaw is severe due to its potential for combined exploitation scenarios. While merely activating an admin account might not immediately grant full control if password authentication remains intact, it becomes critical when paired with other vulnerabilities or misconfigurations involving credential management. For instance, if a user can also reset the password of that activated administrator account through subsequent actions or related flaws, they effectively assume complete identity and privilege level of the target administrator. This leads to unauthorized administrative access, enabling full control over the CMS installation, including content modification, plugin configuration, database manipulation, and potential server-level compromises depending on deployment architecture.
From a classification perspective, this vulnerability aligns with CWE-269: Improper Privilege Management, as it involves an actor obtaining privileges that they are not explicitly authorized to hold due to flawed access control logic. Furthermore, in the context of the MITRE ATT&CK framework, this behavior is indicative of T1078: Valid Accounts, specifically where attackers leverage existing valid credentials and exploit authorization flaws to maintain persistence or escalate privileges within a compromised environment. The lack of consistent enforcement across related administrative actions highlights a systemic design flaw rather than an isolated coding error.
Mitigation strategies primarily involve upgrading the Craft CMS installation to version 5.10.12, which includes the necessary code changes to enforce administrator-level checks for activating admin accounts. For environments where immediate patching is not feasible due to dependency constraints or testing requirements, temporary mitigations should focus on restricting the administrateUsers permission strictly to users who are already designated as administrators within the system roles configuration. Additionally, implementing strict monitoring and alerting around user activation events can help detect suspicious activity patterns indicative of exploitation attempts. Regular audits of role-based access control policies ensure that permissions are granted on a least-privilege basis, reducing the attack surface available to lower-tier users who might otherwise exploit such authorization gaps.