Craft CMS EUVD-2026-104581

Exploitation requires that (1) the attacker obtains the victim's emailed verification code for an email-change operation, and (2) the victim actually completes the email-change verification via users/verify-email, which leaves the code valid; the attacker then replays that code to users/set-password. The decisive limiting factor is possession of the one-time code - the flaw is that Craft CMS 5.0.0-5.10.x fails to invalidate verification codes for active users, so the attack is not possible against patched 5.11.0+ and is impractical without access to the code. This constrains exploitation to attackers with email interception/access or control of the change flow, making it targeted rather than broadly remote despite the network attack vector.

This is a credible, above-average-priority issue but not a drop-everything emergency. The vendor-supplied CVSS 4.0 vector (8.7, AV:N/AC:L/PR:N/UI:N) frames it as a remote, unauthenticated, no-interaction attack with high confidentiality impact (VC:H), which maps to a network-exploitable authentication bypass (CWE-287). However, the description materially qualifies that framing: the attacker must OBTAIN the victim's emailed verification code AND the victim must independently verify an email change - so in practice there IS a precondition (code possession) and a form of victim-triggered interaction that the AC:L/UI:N metrics understate. This is a signal conflict worth flagging: CVSS indicates trivial remote exploitation, but the description implies the attacker needs out-of-band access to a one-time code and a specific user action, suggesting targeted rather than spray-and-pray exploitation. No EPSS score was provided in the input, the CVE is NOT on CISA KEV, and no public POC is referenced, so there is no active-exploitation or weaponization signal. Net: a real authentication/account-takeover flaw in a widely-used CMS that should be patched promptly (upgrade to 5.11.0), but current evidence points to conditional, targeted abuse rather than mass exploitation.

An attacker who can intercept or otherwise obtain a victim's emailed email-change verification code (e.g., via email access, a leaked message, or an attacker-initiated change flow) waits until the victim completes the email verification, then replays that still-valid code against the users/set-password endpoint to reset the victim's password and seize the account. Because users/verify-email never invalidates the code for active users, the code remains reusable. No public exploit code is identified at time of analysis.