Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-29069 is a moderate severity vulnerability in Craft CMS affecting versions before 5.9.0-beta.2 and 4.17.0-beta.2. The issue lies in the actionSendActivationEmail() endpoint, which is accessible to unauthenticated users and does not verify ownership of pending user accounts.'}, {'type': 'paragraph', 'content': "An attacker who knows or guesses a pending user's ID can trigger activation emails for that user. If the attacker controls the target user's email address, they can activate the account, set a password, and gain unauthorized access to the system."}, {'type': 'paragraph', 'content': 'The vulnerability arises because the endpoint accepts a userId parameter without verifying that the requester owns the account, allowing arbitrary triggering of activation emails and potential account takeover.'}] [2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to take over pending user accounts if they control the associated email addresses.

• Targeted Account Takeover: Attackers can activate accounts and gain unauthorized access by triggering activation emails for pending users whose email addresses they control.
• User ID Enumeration: Attackers can brute-force or enumerate user IDs to discover user states and map user accounts.
• GraphQL-Assisted Attacks: If public GraphQL queries expose user data, attackers can identify pending users and target them for account takeover.
• Email Spam and Harassment: Attackers can repeatedly trigger activation emails to harass users, damage reputation, and cause email deliverability issues.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by monitoring for unauthorized or unusual POST requests to the actionSendActivationEmail() endpoint, especially those that include arbitrary or sequential userId parameters.'}, {'type': 'paragraph', 'content': 'Detection methods include checking server logs or web application firewall logs for repeated or suspicious activation email requests that do not originate from authenticated users.'}, {'type': 'paragraph', 'content': 'Commands to help detect this activity might include using tools like curl or wget to simulate requests, or using grep to search logs for relevant patterns.'}, {'type': 'list_item', 'content': "Example command to search web server logs for POST requests to the vulnerable endpoint: grep 'POST /actions/users/send-activation-email' /path/to/access.log"}, {'type': 'list_item', 'content': "Example command to detect repeated activation email triggers by userId: grep 'userId=' /path/to/access.log | sort | uniq -c | sort -nr"}, {'type': 'list_item', 'content': "Use curl to test if the endpoint is accessible without authentication: curl -X POST -d 'userId=1' https://your-craftcms-site.com/actions/users/send-activation-email -v"}] [2]

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'Immediate mitigation steps include upgrading Craft CMS to version 5.9.0-beta.2 or later, or 4.17.0-beta.2 or later, where the vulnerability is fixed.'}, {'type': 'paragraph', 'content': "The fix involves enforcing strict permission checks, requiring POST requests from authenticated users with the 'editUsers' permission, and removing anonymous access to the actionSendActivationEmail() endpoint."}, {'type': 'paragraph', 'content': 'If upgrading immediately is not possible, consider implementing temporary access controls such as restricting access to the vulnerable endpoint via firewall rules or web application firewall (WAF) rules to block unauthenticated requests.'}, {'type': 'paragraph', 'content': 'Monitor and rate-limit requests to the activation email endpoint to prevent brute-force enumeration or spam attacks.'}] [1, 2]

Useful 0 Not Useful 0