CVE-2026-84801: Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers
Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new password via actionSetPassword, which validates only the verification code without checking the caller's session, enabling complete control-panel takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Craft CMSto a version that resolves this vulnerability.Fixed in 5.10.11 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch Authentication Bypass via administrateUsers
Event History
Frequently Asked Questions
Which users can exploit this issue?
A non-administrator Craft CMS user who has the administrateUsers permission can exploit it. The attacker can target administrator accounts and take over the control panel.
Does exploitation require user interaction or prior access?
No user interaction is required, but the attacker needs an authenticated non-admin account with the administrateUsers permission. They can generate a password reset URL for an administrator and use its verification code to set a new password.
How can I tell whether my installation is affected?
Craft CMS versions from 5.0.0-RC1 through versions before 5.10.11 are affected. Review whether any non-admin accounts have been granted the administrateUsers permission, as those accounts could generate reset URLs for administrators.