CVE-2026-72786

Deferred Deferred - Pending Action

Authentication Bypass in Craft CMS Password Reset

Publication date: 2026-08-12

Last updated on: 2026-08-31

Assigner: VulnCheck

Description

Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the unprotected newPassword field in the User element save flow.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-31

Generated

2026-09-02

AI Q&A

2026-08-13

EPSS Evaluated

2026-08-31

NVD

CVE-2026-72786

EUVD

EUVD-2026-57446

Affected Vendors & Products

Vendor	Product	Version / Range
craft_cms	craft_cms	to 5.10.8 (exc)
craftcms	craft_cms	From 5.0.0-RC1 (inc) to 5.10.7 (inc)
craftcms	craft_cms	5.10.8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

CVE-2026-72786 is an authentication bypass flaw in Craft CMS versions before 5.10.8. It allows authenticated users with edit permissions to reset passwords for any user, including administrators, by exploiting an unprotected field in the User element save flow. This improper authorization issue enables attackers to bypass password verification and take over accounts.

Detection Guidance

Check Craft CMS version with: composer show craftcms/cms or grep -r 'craftcms/cms' vendor/composer/installed.json. Look for versions before 5.10.8. Review user permission logs for unauthorized password reset attempts via elements/save action.

Impact Analysis

If exploited, this vulnerability allows attackers to reset passwords and gain control of administrator accounts, leading to full system compromise. Even users with basic edit permissions can reset other users' passwords, including those of administrators, without proper verification.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Unauthorized password resets could allow attackers to access personal or protected health information, triggering potential legal and regulatory penalties for affected organizations.

Mitigation Strategies

Upgrade Craft CMS to version 5.10.8 or later immediately. Remove edit users permission from non-admin accounts until patched. Monitor for suspicious password reset activities in admin logs.

Hi! I’m here to help you understand CVE-2026-72786. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70