CVE-2026-124429: Craft CMS 5.0.0 before 5.11.2 Privilege Escalation via Public Registration

Published Nov 8, 2026

Updated

Craft CMS from 5.0.0 before 5.11.2 contains a privilege escalation vulnerability that allows unauthenticated public registrants to reclaim deactivated non-admin accounts while retaining their direct permissions. Attackers can register using a deactivated account, set a new password, and inherit permissions stored in userpermissionsusers, enabling privileged account takeover when email verification is disabled.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Craft CMS to a version that resolves this vulnerability.
Fixed in 5.11.2

Event History

Nov 8, 2026

CVE Published

via MITRE·01:15 PM

Data Sourced

via MITRE·01:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Craft CMS versions from 5.0.0 before 5.11.2 are affected when public registration is enabled and email verification is disabled. The attack targets deactivated non-admin accounts that retain direct permissions.

What does an attacker need to exploit it?

An attacker does not need an existing account or user interaction. They need to register publicly using the identity of a deactivated non-admin account; they can then set a new password and inherit that account's directly assigned permissions.

Are administrator accounts affected?

The described account-reclamation path applies to deactivated non-admin accounts. The provided information does not state that deactivated administrator accounts can be reclaimed through this issue.

What can be done if an upgrade is not immediately possible?

Disable public registration or enable email verification to prevent the described unauthenticated registration path. Review deactivated non-admin accounts with direct permissions, as those permissions may be inherited if the account is reclaimed.

CVE-2026-124429: Craft CMS 5.0.0 before 5.11.2 Privilege Escalation via Public Registration

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Are administrator accounts affected?

What can be done if an upgrade is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

Are administrator accounts affected?

What can be done if an upgrade is not immediately possible?