CVE-2026-92591 in Craft CMS
Summary
by MITRE • 09/17/2026
Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed production site whenever PHP remains available but the configured MySQL endpoint does not. The action accepts a site name, serializes it through Site::getName(), and expands ${NAME} expressions using App::env(). An unauthenticated attacker who obtained a guest session cookie and matching CSRF token before the outage and whose session remains valid during it can submit a predictable variable name (for example Craft's conventional CRAFT_SECURITY_KEY) and receive its value, disclosing Craft secrets, process environment variables, $_SERVER entries, or PHP constants such as the security key, database credentials, or API keys. The issue requires an independently occurring database outage; the vulnerability itself provides no way to induce it. Fixed in 5.10.13.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in Craft CMS versions 5.0.0 through 5.10.12 represents a critical logic flaw rooted in how the application handles database connectivity failures during its initialization phase. Under normal operational conditions, Craft CMS performs specific checks to determine if it has been installed and configured correctly before allowing access to administrative or installation endpoints. However, when the system encounters a failure to connect to the designated MySQL database endpoint while PHP execution remains available, the software incorrectly interprets this state as an indication that the application is not yet installed. This misclassification effectively bypasses authentication and authorization controls, exposing internal installer actions such as install/validate-site to unauthenticated users. The core technical flaw lies in the assumption that a missing database connection equates to a fresh installation rather than recognizing it as a transient infrastructure failure on an existing production environment.
This architectural oversight allows attackers who possess valid guest session cookies and corresponding CSRF tokens prior to or during a database outage to interact with these exposed endpoints. By submitting requests containing predictable variable names, such as the conventional CRAFT_SECURITY_KEY placeholder, the application processes these inputs through Site::getName() and expands ${NAME} expressions using App::env(). This mechanism inadvertently triggers an environment variable disclosure vulnerability. Instead of returning installation configuration data for a new setup, the system reveals sensitive information from the existing production environment because it mistakenly believes no such environment exists yet. Consequently, attackers can extract high-value secrets including database credentials, API keys, security keys, and various PHP server variables that were intended to remain confidential within the application's runtime context.
The operational impact of this vulnerability is severe due to its potential for complete system compromise if an attacker successfully retrieves critical authentication tokens or database passwords. The disclosure of the CRAFT_SECURITY_KEY alone can facilitate session forgery or decryption of sensitive data stored in the CMS, while exposure of database credentials allows direct access to persistent storage containing user information and content. Although the vulnerability requires a coincident database outage to be exploitable, this condition does not significantly reduce its severity as outages are common occurrences in complex IT environments. The attacker must also have obtained valid session tokens beforehand, which may involve standard phishing or cross-site scripting attacks if those vectors exist within the same deployment. This combination of conditions creates a realistic attack path that leverages infrastructure instability to escalate privileges and exfiltrate sensitive configuration data.
From a classification perspective, this issue aligns with CWE-209: Generation of Error Message Containing Sensitive Information, as it results in the exposure of internal system states and secrets through error handling logic flaws. It also relates to CWE-613: Insufficient Session Expiration because the exploitability depends on maintaining a valid guest session during the outage window. In terms of offensive security frameworks, this vulnerability maps to ATT&CK technique T1504.002: Web Server Component Discovery and potentially T1078.001: Default Accounts if default credentials are exposed, though primarily it serves as an information disclosure vector that enables further exploitation steps such as credential theft or session hijacking. The vulnerability is not a direct injection attack but rather a logic error in state management where the application fails to distinguish between unconfigured and misconfigured states.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary defense is upgrading Craft CMS to version 5.10.13 or later, which resolves this specific logical flaw by correctly handling database connection failures without exposing installer endpoints. For environments where immediate patching is not feasible, administrators should implement strict network-level controls such as Web Application Firewalls that can detect and block requests targeting installation paths when the application state indicates a production environment. Additionally, ensuring robust session management policies with shorter timeouts for guest sessions reduces the window of opportunity for attackers to exploit this condition during an outage. Developers should also review how error handling routines interact with security-sensitive endpoints to ensure that infrastructure failures do not inadvertently disable authentication checks or expose internal configuration mechanisms.