CVE-2026-84801
Received Received - Intake

Authentication Bypass in Craft CMS Admin Panel

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: VulnCheck

Description
Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL for any admin user and set a new password via actionSetPassword, which validates only the verification code without checking the caller's session, enabling complete control-panel takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84801
EUVD
EUVD-2026-69913

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
craftcms craft_cms From 5.0.0-rc1 (inc) to 5.10.11 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Craft CMS versions before 5.10.11 have a flaw where non-admin users with the 'administrateUsers' permission can generate password reset URLs for admin accounts. The system fails to validate admin status in the actionGetPasswordResetUrl endpoint, allowing attackers to mint valid reset links. These links can then be used in the actionSetPassword endpoint to change an admin's password without session validation, leading to full control-panel takeover.

Detection Guidance

Check Craft CMS version with: composer show craftcms/cms. If version is below 5.10.11, the system is vulnerable. Review user permissions for non-admin users with 'administrateUsers' permission. Monitor logs for unusual password reset URL generation events.

Impact Analysis

If exploited, attackers can gain complete control of the Craft CMS control panel. This allows them to modify site content, access sensitive data, create new admin accounts, or disrupt operations. The impact is severe as it bypasses normal authentication safeguards.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Organizations using vulnerable Craft CMS versions may face compliance breaches, legal penalties, and reputational damage due to potential data exposure.

Mitigation Strategies

Upgrade Craft CMS to version 5.10.11 or later immediately. Remove 'administrateUsers' permission from non-admin users. Audit all admin accounts for unauthorized password changes. Consider temporary disabling password reset functionality until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84801. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart