CVE-2026-112775 in Craft CMS
Сводка
по MITRE • 19.10.2026
Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.
If you want to get best quality of vulnerability data, you may have to visit VulDB.