Silverstripe MFA CVE-2026-55186

The attacker must have access to the target user's email account (to receive and act on the password-reset message), and the target must be a CMS 5 user with multi-factor authentication enabled on the silverstripe/mfa module at a version below 6.0.0. The vulnerable behaviour is specific to the password-reset flow, which issues a logged-in session before the MFA step completes. Limiting factors: CMS 6 is explicitly not affected; the required prior compromise of the victim's email account is a substantial, out-of-band precondition that makes exploitation targeted rather than mass-exploitable, and it is the main reason the issue is treated as 'this_month' priority despite being network-reachable.

This is a genuine but low-priority flaw rather than a high-severity emergency. The input CVSS base score is 4.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N): network-reachable but high attack complexity, limited confidentiality and integrity impact, no availability impact. The decisive limiter is the stated precondition - exploitation requires access to the victim's email account - which means the attacker must already have compromised an out-of-band factor before the MFA bypass yields any benefit, pointing to targeted rather than opportunistic abuse. There is no CISA KEV listing, no EPSS score supplied, and no public exploit or PoC reference in the provided data, so exploitation status is: no public exploit identified at time of analysis. The vuln.today priority label is 'this_month' (not act_now or emergency), which is consistent with the modest CVSS and the heavy prerequisite. Note one internal tension: the attacker needs the victim's email account, yet the supplied CVSS encodes that effort as PR:L/AC:H rather than purely as complexity - verify the intended metric model with the vendor advisory, though it does not change the practical conclusion that this is a secondary escalation (MFA defeat) on top of an already-compromised email account.

An attacker who has already compromised a CMS 5 user's email account triggers the Silverstripe password-reset flow, receives the reset link in that mailbox, and sets a new password. In the vulnerable flow the user is granted a logged-in session immediately, before the multi-factor challenge is completed, so the MFA protection is bypassed. No public exploit code is referenced in the available data; the AV:N/AC:H profile reflects that the network-facing flow still depends on the external email-access precondition.