Craft CMS CVE-2026-84801

Exploitation requires an authenticated Craft CMS session where the user account has been explicitly granted the administrateUsers permission - this is not granted to ordinary users or editors by default and must be assigned by an existing administrator. The target must be a Craft CMS 5.x installation (specifically 5.0.0-rc1 through 5.10.10). No special network position, non-default configuration, or user interaction from the victim is required beyond the attacker's own valid session. Limiting factors: the attacker population is restricted to users the site's administrators have already trusted with user-management duties; unauthenticated or low-permission users cannot reach the vulnerable endpoint.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, score 8.7) accurately characterizes the attack: network-reachable, mechanically simple, no user interaction, but requiring PR:L - a valid authenticated session with the administrateUsers permission. This prerequisite meaningfully narrows the exposed surface compared to an unauthenticated flaw: only users explicitly trusted to manage other users are in scope. In multi-tenant Craft deployments, agencies operating on behalf of clients, or organizations where administrateUsers is granted to junior editors or client contacts, this population can be non-trivial. The full C:H/I:H/VA:H impact reflects a complete CMS admin takeover - the attacker can read all content, modify any data, and lock out legitimate administrators. No EPSS data was supplied; without KEV listing or published POC, opportunistic mass exploitation is not indicated, but targeted insider or supply-chain abuse is plausible. CVSS and description are consistent - no conflicting signals identified.

An attacker who holds a Craft CMS account with the administrateUsers permission authenticates to the control panel, then issues a crafted POST to actionGetPasswordResetUrl naming a target administrator's account. Craft returns a valid signed reset URL; the attacker follows it (or extracts the token and calls actionSetPassword directly), sets a new password of their choice, and logs into the target administrator's session. No public exploit code has been identified at time of analysis, but the steps are straightforward to reconstruct from the advisory description.