CVE-2026-84795: Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance
Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification are configured.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.10.11
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running Craft CMS before 5.10.11 are exposed when public user registration is enabled and email verification is disabled. Exploitation also depends on the presence of a deactivated administrator account whose email address can be used for registration.
What does an attacker need to exploit the vulnerability?
An attacker needs network access to the public registration function and must register using the email address of a deactivated administrator account. No existing account privileges or user interaction are required under the affected configuration.
What can be done if upgrading is not immediately possible?
Disable public user registration or enable email verification to prevent the described registration path. Review deactivated administrator accounts, particularly their email addresses, because those accounts are relevant to exploitation.
How can administrators assess whether they may already be affected?
Check whether the installation is running a version before 5.10.11, whether public registration is enabled, and whether email verification is disabled. Also review registrations associated with email addresses belonging to deactivated administrator accounts and verify whether any such users have administrator privileges.