CVE-2026-72786: Craft CMS 5.0.0-RC1 before 5.10.8 Authentication Bypass via Password Reset
Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the unprotected newPassword field in the User element save flow.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.10.8
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72786?
The severity of CVE-2026-72786 is rated as medium with a score of 6.5.
How do I fix CVE-2026-72786?
To fix CVE-2026-72786, you should update Craft CMS to version 5.10.8 or later.
What type of vulnerability is CVE-2026-72786?
CVE-2026-72786 is an authentication bypass vulnerability affecting Craft CMS.
Who can exploit CVE-2026-72786?
Authenticated users with edit users permission can exploit CVE-2026-72786 to reset any user's password.
What impact does CVE-2026-72786 have?
The impact of CVE-2026-72786 allows unauthorized password changes, potentially compromising user accounts.