Craft CMS CVE-2026-86731

Exploitation requires: (1) an active authenticated session in the Craft CMS control panel - anonymous access is insufficient; (2) the attacking account must hold the administrateUsers permission but must NOT itself be a full administrator - full admins have no incentive to exploit this path; (3) at least one administrator account must exist in a pending or deliberately deactivated state on the target instance - without a dormant admin account to target, the activation step has no useful effect; and (4) a second mechanism (such as password reset) must be available or accessible to claim the newly activated admin account. The flaw does not exist in the deactivation path (actionDeactivateUser), only in activation. Exploitation is network-accessible with no special positioning required (AV:N, AC:L). Craft CMS 5.x only - earlier major versions are outside the advisory scope.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) yields a 7.1 score, reflecting network-accessible exploitation with low-privilege authenticated access and no attack complexity or user interaction requirements. The direct impact is integrity-only (VI:H) - no data is read or service disrupted by the activation step alone - but the realistic escalation chain elevates this: activating a dormant admin account followed by a password reset delivers full CMS administrator access, making the practical impact substantially higher than the raw integrity metric suggests. The exploitable population is constrained to control panel users who hold the administrateUsers permission but are not themselves administrators, limiting opportunistic exploitation to insiders or compromised editor-level accounts. No CISA KEV listing and no public proof-of-concept are present at time of analysis, suggesting no active mass exploitation. EPSS data was not provided. The internal-threat model is the primary risk: a malicious or compromised non-admin operator deliberately targeting dormant admin accounts to escalate privileges.

An authenticated Craft CMS control panel user with the administrateUsers permission - such as a content editor elevated to manage other users - identifies a dormant or pending administrator account (e.g., a former site owner whose account was deactivated). The attacker sends a crafted POST request to the users/activate-user endpoint targeting that admin account; because requireAdmin() is not called, the request succeeds and the account is re-enabled. The attacker then initiates a password reset for that now-active administrator account, gaining full CMS administrative access including plugin management, system configuration, and file-system write operations.