CVE-2026-84795
Received Received - Intake

Craft CMS Admin Privilege Escalation via Deactivated User Registration

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: VulnCheck

Description
Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification are configured.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84795
EUVD
EUVD-2026-69907

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
craftcms craft_cms to 5.10.11 (exc)
craftcms craft_cms From 5.0.0-RC1 (inc) to 5.10.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Craft CMS before 5.10.11 fails to validate the admin flag during user registration. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification are configured.

Detection Guidance

Check Craft CMS version with: composer show craftcms/cms. If version is below 5.10.11, the system is vulnerable. Review user registration settings in config/general.php for allowPublicRegistration and requireEmailVerification flags.

Impact Analysis

Attackers gain full administrator access to the control panel, user management, system settings, plugins, and all content. This allows unauthorized changes, data theft, or system disruption.

Compliance Impact

This vulnerability allows unauthorized privilege escalation to administrator access, which could lead to unauthorized access, modification, or deletion of sensitive data. This violates compliance requirements for data protection standards like GDPR (data integrity and confidentiality) and HIPAA (unauthorized access to protected health information).

Mitigation Strategies
  • Upgrade Craft CMS to version 5.10.11 or later immediately.
  • Disable public registration (set allowPublicRegistration=false) if not required.
  • Enable email verification (set requireEmailVerification=true) for all registrations.
  • Audit all admin accounts for deactivated entries and remove any lingering admin privileges.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84795. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart