Authentication Bypass in Craft CMS via Email Verification Code Reuse

Executive Summary

CVE-2026-112775 is an authentication bypass vulnerability in Craft CMS versions 5.0.0 to 5.10.0. It allows attackers to reuse verification codes for email changes to later reset a victim's password. The issue occurs because the system does not invalidate verification codes after they are used for email verification, enabling attackers who obtain a victim's emailed code to submit it for password reset and take over the account.

Useful 0 Not Useful 0

Detection Guidance

Check Craft CMS version with: composer show craftcms/cms. If version is between 5.0.0 and 5.10.0, the system is vulnerable. Review logs for unusual password reset attempts or email change verifications.

Useful 0 Not Useful 0

Impact Analysis

If you use Craft CMS versions 5.0.0 to 5.10.0, an attacker could exploit this vulnerability to take over your account. They would need to obtain your emailed verification code, trick you into changing your email address, then use the same code to reset your password and gain unauthorized access to your account.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized account access, potentially violating data protection requirements under GDPR and HIPAA. GDPR mandates strict access controls and user consent for data changes, while HIPAA requires safeguards to prevent unauthorized access to protected health information. The authentication bypass may result in non-compliance if user accounts are compromised.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Craft CMS to version 5.11.0 or later immediately. If upgrading is not possible, disable email change functionality or implement additional verification steps for password resets.

Useful 0 Not Useful 0