Craft CMS EUVD-2026-69907

Requires the target Craft CMS instance (before 5.10.11) to have public/allow-self-registration enabled AND email verification for new users disabled - both non-default hardening-dependent settings. The attacker must also know or guess the email address of an administrator account that was deactivated (not deleted); the vulnerable admin-flag inheritance keys off that reused email. No authentication is needed to perform the registration (PR:N), and no victim interaction is required (UI:N). Limiting factors: sites that delete removed admins, keep email verification on, or disable public registration are not exploitable.

This is a genuine high-priority issue where the required preconditions are met, but those preconditions meaningfully narrow the exposed population. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, VC:H/VI:H/VA:H, base 9.2) reflects full compromise of confidentiality, integrity and availability with no authentication, while the AT:P (Attack Requirements: Present) metric explicitly encodes the non-default configuration dependency. There is no CVSS 3.1 vector, EPSS score, KEV listing, or POC indicator in the provided data, so real-world exploitation pressure cannot be quantified - the honest read is a serious flaw with strong impact but conditional reachability. It is not currently confirmed actively exploited and no public exploit code is identified; the risk is largely governed by whether a site runs public registration with email verification disabled and has ever deactivated (rather than deleted) an admin whose email an attacker can learn.

On a Craft CMS site with public registration enabled and email verification turned off, an attacker learns the email of a former administrator whose account was deactivated rather than deleted. The attacker submits the public registration form using that email address and is immediately provisioned with administrator privileges, gaining full control of the CMS content, users, and settings.