Privilege Escalation in Craft CMS via Deactivated Account Reclamation

Executive Summary

Craft CMS versions 5.0.0 to 5.11.1 have a privilege escalation flaw where unauthenticated public registrants can reclaim deactivated non-admin accounts while retaining their direct permissions. Attackers register using a deactivated account, set a new password, and reactivate the account with its original permissions intact. This enables privileged account takeover if email verification is disabled.

Useful 0 Not Useful 0

Detection Guidance

Check Craft CMS version with: composer show craftcms/cms. If version is between 5.0.0 and 5.11.1, the system is vulnerable. Review userpermissions_users table for inactive accounts with elevated permissions. Inspect registration logs for unusual account reactivations.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain unauthorized access to privileged accounts, potentially taking over admin or sensitive user accounts. This could lead to data breaches, unauthorized modifications, or full system compromise if email verification is not enforced during registration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Organizations using affected Craft CMS versions may face compliance violations, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Craft CMS to version 5.11.2 or later immediately. Enable email verification for all user registrations. Review and remove direct permissions from inactive accounts in userpermissions_users table. Monitor for unauthorized account reactivations.

Useful 0 Not Useful 0