CVE-2026-79989: Arbitrary user password reset leading to administrator account takeover
The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission (which doesn’t allow changing others’ passwords) and lacks Administrate users permission (which is required to change others’ passwords).
Event History
Frequently Asked Questions
What level of access does an attacker need?
An attacker must be authenticated. Any authenticated user can change their own password without supplying the current password or having an active elevated session.
When can an attacker reset another user’s password?
The attacker must have the Edit users permission. The issue applies even when that account does not have Administrate users permission, which is normally required to change other users’ passwords.
Which accounts are most at risk of takeover?
Accounts whose passwords can be changed by an authenticated user with Edit users permission are at risk, including administrator accounts if they are among the users the attacker can target.