Which versions of Craft CMS are affected by CVE-2026-72786?

Craft CMS versions 5.0.0-RC1 through 5.10.7 contain an authorization flaw that permits control panel users with 'edit users' permissions to reset administrator passwords and seize full platform…. A patch is available.

How to fix or mitigate CVE-2026-72786?

Within 24 hours, create an inventory of all Craft CMS instances in use, identify those running versions 5.0.0-RC1 through 5.10.7, and audit all current users holding 'edit users' permissions to determine exposure scope. Within 7 days, upgrade all affected Craft CMS instances to version 5.10.8 or later, prioritizing production and revenue-generating sites. Within 30 days, conduct a comprehensive audit of administrative account password changes for the period preceding the vulnerability disclosure, investigate any suspicious modifications, implement enhanced logging and alerting for administrative account access and password operations, and consider implementing additional approval workflows for privileged account management.

Craft CMS CVE-2026-72786

Q: What is the CVSS score of CVE-2026-72786?

CVE-2026-72786 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-57446 HIGH

Improper Authorization (CWE-285)

2026-08-12 VulnCheck

GHSA-9j4x-96g5-572j

Authentication Bypass Cms Craftcms

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.6 CRITICAL

Scope changes as low-privileged user can affect admin accounts; both confidentiality and integrity are fully compromised via account takeover.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 12, 2026 - 20:03 EUVD

Source Code Evidence Fetched

Aug 12, 2026 - 19:54 vuln.today

Analysis Generated

Aug 12, 2026 - 19:54 vuln.today

CVE Published

Aug 12, 2026 - 19:07 cve.org

HIGH 7.1

DescriptionCVE.org

Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the unprotected newPassword field in the User element save flow.

AnalysisAI

Improper authorization in Craft CMS 5.0.0-RC1 through 5.10.7 exposes the generic elements/save action to silent password manipulation, enabling any authenticated control panel user to reset their own password without confirming their current credentials. More critically, attackers holding the edit users permission can silently overwrite passwords for any account on the platform-including administrator accounts-achieving full administrative takeover without requiring the legitimately guarded Administrate users privilege. A vendor-released patch exists in version 5.10.8, and no public exploit code is identified at time of analysis, though the GHSA advisory's detailed technical description materially lowers the bar for independent exploitation.

Technical ContextAI

Craft CMS (CPE: cpe:2.3:a:craftcms:cms:*:*:*:*:*:*:*:*, Composer package craftcms/cms) is a PHP-based content management system. The root cause is CWE-285 (Improper Authorization): the UserPasswordValidator applies only a safe validation rule to the newPassword field during User element save operations, without restricting this rule to a specific validation scenario. This omission makes newPassword mass-assignable through the generic elements/save controller action, completely bypassing the dedicated users/set-password endpoint which enforces elevated session verification before permitting credential changes. The architectural flaw is that two separate code paths can modify user passwords, but only one enforces proper authorization checks. The vulnerability was introduced in version 5.0.0-RC1 and persists through all 5.x releases prior to 5.10.8.

RemediationAI

Upgrade the craftcms/cms Composer package to version 5.10.8 or later by running composer update craftcms/cms; this is the vendor-released patch addressing the issue via commit cbdf45fbd3ab548b147d7de375f6f6f580b7c294, as documented in GHSA-p8x7-9vfw-p7vc. If immediate patching is not operationally feasible, administrators should audit and minimally scope the edit users permission, removing it from all accounts where it is not strictly necessary, since this permission is the prerequisite for the administrator account takeover scenario. As a supplementary compensating control, enforcing multi-factor authentication on all administrator accounts will not prevent an attacker from resetting credentials but will delay successful login after a password reset, providing a window for detection. Enabling and actively monitoring Craft CMS control panel audit logs for unexpected password change events via the elements/save endpoint can provide early warning of exploitation attempts. Note that restricting edit users alone does not eliminate the self-password-reset variant of the vulnerability, which affects all authenticated users regardless of permissions.