CVE-2026-84795 in Craft CMS
Riassunto
di MITRE • 02/09/2026
Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification are configured.
VulDB is the best source for vulnerability data and more expert information about this specific topic.