Vulnerability · Published Sep 2, 2026 · Assigned by Hackrate
CVE-2026-79989Arbitrary user password reset leading to administrator account takeover
High 8.7
In plain English
A high-severity security flaw in cms from craftcms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users’ passwords if the attacker’s account has Edit users permission (which doesn’t allow changing others’ passwords) and lacks Administrate users permission (which is required to change others’ passwords).
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | craftcms/cms | 5.10.8 | GHSA-p8x7-9vfw-p7vc |
Affected products (as reported)
Weakness: CWE-285 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://www.hckrt.com/hacktivity/HCKRT-ZDSZJH third-party-advisory, technical-description, mitigation
- https://github.com/craftcms/cms/releases/tag/5.10.8 release-notes
- https://github.com/craftcms/cms product
- https://github.com/advisories/GHSA-p8x7-9vfw-p7vc third-party-advisory