Craft CMS CVE-2026-79987

Exploitation requires: (1) a valid Craft CMS Control Panel account with at minimum the accessCp permission - no admin role needed; (2) network reachability to the CP endpoint. Exploitation is limited by the need for prior authentication - unauthenticated external attackers cannot exploit this directly. In deployments where accessCp is tightly restricted to a small set of trusted administrators the realistic risk surface is narrow. In deployments with broad editorial team CP access the practical attacker pool is significantly larger. No non-default configuration flag is required beyond having the CP accessible and the user account created.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately reflects the severity when CP access is achievable. The PR:L metric is the key risk-limiting factor: exploitation requires a valid CP account with at least accessCp permission, meaning externally unauthenticated attackers cannot exploit this directly. However, in many Craft CMS deployments editorial teams, marketing staff, and contractors are granted CP access, substantially widening the realistic attacker pool beyond a purely technical reading of 'authenticated.' No EPSS score is provided in the input data, and the CVE is not listed in CISA KEV, so no confirmed active exploitation exists. No POC is publicly known. The release notes explicitly label the fixes as 'high-severity RCE vulnerabilities,' consistent with the CVSS signal. Real-world prioritization should be driven by how broadly accessCp is granted in the target organisation - tightly controlled deployments face lower risk than those with many CP users.

An attacker who holds (or has compromised) a Craft CMS CP account with only the baseline accessCp permission authenticates to the Control Panel over the network and submits a crafted payload that exploits unsafe reflection (CWE-470) to invoke a PHP class or method that ultimately calls an OS-level command. The commands execute as the PHP web worker user (e.g., www-data), giving the attacker full server-side command execution. No publicly known POC exists, but the attack surface is accessible to any low-privilege CP user without further privilege escalation.