CVE-2026-79989
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Summary
The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission (which doesn’t allow changing others’ passwords) and lacks Administrate users permission (which is required to change others’ passwords).
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| craftcms | cms | 5.0.0-RC1 < 5.10.8 | affected |
Weaknesses
- CWE-285: CWE-285 Improper Authorization
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: total
References
- https://www.hckrt.com/hacktivity/HCKRT-ZDSZJH
- https://github.com/craftcms/cms/releases/tag/5.10.8
- https://github.com/craftcms/cms
- https://github.com/advisories/GHSA-p8x7-9vfw-p7vc
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.