CVE-2026-79989
Received Received - Intake

Authenticated User Password Change Vulnerability in User Management System

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Hackrate

Description
The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission (which doesn’t allow changing others’ passwords) and lacks Administrate users permission (which is required to change others’ passwords).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-79989
EUVD
EUVD-2026-70032

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
craftcms craft_cms From 5.0.0-RC1 (inc) to 5.10.8 (exc)
craftcms craft_cms 5.10.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Craft CMS allows any authenticated user to change their own password without providing the current password or elevated session verification. Users with Edit users permission (but lacking Administrate users permission) can also change other users' passwords, including administrators, leading to potential account takeover.

Detection Guidance

Check Craft CMS version by running: composer show craftcms/cms. If version is between 5.0.0-RC1 and 5.10.7, the system is vulnerable. Review user permission settings for Edit users without Administrate users.

Impact Analysis

An attacker could exploit this to reset passwords of other users, including administrators, gaining unauthorized access to accounts. This could lead to data breaches, unauthorized modifications, or complete system compromise depending on user privileges.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected Craft CMS versions may face compliance violations, legal penalties, and reputational damage due to potential data exposure.

Mitigation Strategies

Upgrade Craft CMS to version 5.10.8 or later immediately. Remove Edit users permission from accounts that lack Administrate users permission. Monitor for unauthorized password changes in user logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79989. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart