Craftcms

CVE	Summary	Severity	CVSS	EPSS	Priority
CVE-2026-84795	Privilege escalation in Craft CMS before 5.10.11 lets remote attackers gain administrator rights by registering a new account using the email address of a previously deactivated admin, because the admin flag is not validated and persists across registration. Exploitation requires public user registration to be enabled and email verification to be disabled. Reported by VulnCheck with a vendor security advisory (GHSA-242m-9wq7-vhwq); no public exploit identified at time of analysis.	CRITICAL	9.2	0.3%	46
CVE-2026-78416	Remote code execution in Craft CMS control panel element-search condition handling affects authenticated low-privilege users across the 4.x and 5.x release lines. The root cause is a JSON cleanse bypass in the condition.config parameter that allows Yii framework behavior and event configuration keys to survive sanitization and be processed as live object-configuration directives after decoding, yielding arbitrary PHP code execution as the web server user. No CISA KEV listing exists and no confirmed public exploit code has been identified at time of analysis; however, the CVSS 4.0 score of 8.7 with PR:L correctly signals a genuine high-severity finding for any deployment where control panel credentials could be compromised.	HIGH	8.7	1.0%	44
CVE-2026-86732	Remote code execution in Craft CMS before 5.10.12 allows authenticated content editors to achieve full server compromise through a PHP class-injection and log-poisoning chain. By supplying a crafted criteria[withTransforms][0][class] parameter to the element-index endpoint, an attacker forces ImageTransforms::normalizeTransform() to instantiate an arbitrary PHP class; chaining this with yii\rbac\PhpManager - a built-in Yii RBAC component - the attacker can execute PHP payloads previously smuggled into request logs via the User-Agent header. No public exploit tool or CISA KEV listing is identified at time of analysis, but the fully documented multi-stage technique materially lowers the expertise barrier for exploitation.	HIGH	8.7	0.5%	44
CVE-2026-79989	Improper authorization in Craft CMS 5.x allows any authenticated control panel user to change their own password without supplying the current credential or holding an elevated session, and allows users holding the `Edit users` permission to reset other users' passwords - including administrator accounts - enabling full account takeover. The flaw exists in the `elements/save` action, where the `UserPasswordValidator` mass-assigns the `newPassword` field outside of any scenario restriction, bypassing the dedicated `users/set-password` action that enforces elevated session checks. No active exploitation is confirmed (not in CISA KEV); vendor-released patch is available in version 5.10.8.	HIGH	8.7	0.3%	44
CVE-2026-79988	Remote code execution in Craft CMS allows authenticated users with Twig template access to escape the sandbox via permissive Yii framework functionality, achieving full confidentiality, integrity, and availability compromise on the host system. The root cause is CWE-693 (Protection Mechanism Failure): the Twig sandbox policy was configured to permit dangerous Yii framework methods capable of executing arbitrary code, rather than enforcing a tight allowlist. The vendor confirmed and patched this as a high-severity RCE in release 5.10.7; no public exploit code has been confirmed at time of analysis, though a Hackrate hacktivity report exists referencing the issue.	HIGH	8.7	0.3%	44
CVE-2026-79990	GraphQL mutation resolvers in Craft CMS allow a token-authenticated user scoped to Site A to create, modify, or delete content entries in any other site (Site B, Site C, etc.) within the same multi-site installation. The saveEntry and deleteEntry resolvers read siteId directly from user-controlled $arguments without invoking ArgumentManager::prepareArguments(), which performs the critical array_intersect check against the GraphQL schema's allowed-sites list. Query resolvers call prepareArguments() correctly and thus enforce site boundaries, making this a mutation-specific authorization bypass. Craft CMS 5.10.11 ships the fix via the new MutationResolver::requireAllowedSite() guard; no public exploit or CISA KEV listing has been identified at time of analysis.	HIGH	8.7	0.3%	44
CVE-2026-84796	Cross-site authorization bypass in Craft CMS before 5.10.11 allows authenticated GraphQL API token holders to escape their assigned site scope and read, modify, or delete content entries belonging to sites they are not authorized to access. The flaw exists in GraphQL entry mutation resolvers, where ArgumentManager::prepareArguments() accepts a caller-supplied siteId argument without verifying the token's authorization against the requested site. The vendor-released patch at 5.10.11 addresses the issue; no active exploitation or public exploit code has been identified at time of analysis.	HIGH	8.7	0.3%	44
CVE-2026-84801	Privilege escalation in Craft CMS before 5.10.11 allows authenticated non-admin users holding the administrateUsers permission to perform a full control-panel takeover by minting valid password reset URLs for administrator accounts. The actionGetPasswordResetUrl endpoint omits a check that the caller holds admin status, and the downstream actionSetPassword endpoint validates only the cryptographic verification code without inspecting the caller's session - meaning any valid reset token is redeemable regardless of who requested it. No public exploit or KEV listing exists at time of analysis, but the attack is mechanically straightforward for any user who has been delegated the administrateUsers permission.	HIGH	8.7	0.2%	44
CVE-2026-86730	Remote code execution in Craft CMS before 5.10.12 is achievable by any authenticated control-panel user through Yii2 behavior injection. The vulnerability arises because string-typed field-layout elements are not properly cleansed before processing, allowing attackers to embed Yii2 behavior attachments and event handlers in JSON-formatted field-layout tab submissions that bypass validation and reach Craft::createObject(), instantiating arbitrary PHP objects and executing attacker-controlled code. No public exploit code is confirmed and this CVE is not listed in CISA KEV, but the low privilege bar - any control-panel account suffices - elevates real-world risk for organizations with multiple editor or author accounts.	HIGH	8.7	0.4%	44
CVE-2026-79987	Remote code execution in Craft CMS allows any authenticated Control Panel user holding only the minimum `accessCp` permission to execute arbitrary operating system commands as the PHP web worker process. The flaw (GHSA-9c4j-cjw3-r3xx, CWE-470) bypasses the assumption that non-administrative CP users are restricted to content management operations. Vendor-released patch version 5.10.13 is confirmed; no public exploit or CISA KEV listing exists at time of analysis.	HIGH	8.7	0.4%	44
CVE-2026-79991	GraphQL mutation resolvers in Craft CMS allow authenticated users to create, modify, or delete content entries in sites they are not authorized to access. The `saveEntry` and `deleteEntry` resolvers read `siteId` directly from raw `$arguments` without invoking `ArgumentManager::prepareArguments()`, which is the function that enforces per-site scope filtering via `array_intersect`. Because query resolvers invoke this guard but mutation resolvers do not, the multi-site authorization boundary is structurally absent for all write operations. Vendor-released patch is available in version 5.10.13, and no public exploit has been identified at time of analysis.	HIGH	7.1	0.3%	36
CVE-2026-84794	Missing authorization enforcement in Craft CMS's assets/move-asset endpoint allows authenticated low-privilege users to move assets into other users' folders and force-delete conflicting files by supplying the force=1 parameter. Versions 5.0.0 through 5.10.10 are affected; version 5.10.11 resolves the flaw. No public exploit code or active exploitation has been identified at this time, but the low attack complexity and absence of special prerequisites beyond a valid account make exploitation straightforward for any authenticated user.	HIGH	7.1	0.2%	36
CVE-2026-84798	Craft CMS versions 5.0.0-RC1 through 5.10.10 allow an authenticated low-privileged contributor to permanently delete canonical entry content by exploiting a broken authorization chain in ElementsController::actionDeleteForSite(). The method authorizes deletion against the user's provisional draft rather than the canonical element, then propagates the destructive action to the canonical record without re-verifying deleteEntriesForSite permission. Deleted content bypasses the recycle bin and is unrecoverable, making this an integrity-destroying flaw despite its mid-range CVSS score. No public exploit code is identified at time of analysis.	HIGH	7.1	0.2%	36
CVE-2026-84800	Missing authorization in Craft CMS 5.0.0-RC1 through 5.10.10 allows an authenticated low-privilege author to overwrite another user's asset files in shared folders. The flaw in AssetsController::actionReplaceFile occurs because the target asset is resolved by folder and filename after the replacePeerFiles permission check has already executed - omitting the assetId parameter in the request causes the application to silently bypass the peer-replacement gate. The vendor released a fix in version 5.10.11; no public exploit code has been identified at time of analysis.	HIGH	7.1	0.2%	36
CVE-2026-86731	Craft CMS 5.0.0-RC1 through 5.10.11 allows an authenticated control panel user with the `administrateUsers` permission - but without administrator status - to activate pending or deliberately deactivated administrator accounts via the `users/activate-user` action. The `actionActivateUser` method in `UsersController` correctly gates itself behind `administrateUsers` but omits the `requireAdmin()` call that the mirror `actionDeactivateUser` action uses when the target is an administrator, creating an asymmetric authorization implementation. When chained with a password-reset request on the newly activated admin account, a non-admin operator can achieve full administrator control of the CMS. No public exploit identified at time of analysis; the issue is fixed in Craft CMS 5.10.12.	HIGH	7.1	0.2%	36

CVE-2026-84795

Privilege escalation in Craft CMS before 5.10.11 lets remote attackers gain administrator rights by registering a new account using the email address of a previously deactivated admin, because the admin flag is not validated and persists across registration. Exploitation requires public user registration to be enabled and email verification to be disabled. Reported by VulnCheck with a vendor security advisory (GHSA-242m-9wq7-vhwq); no public exploit identified at time of analysis.

CRITICAL

9.2

0.3%

46

CVE-2026-78416

Remote code execution in Craft CMS control panel element-search condition handling affects authenticated low-privilege users across the 4.x and 5.x release lines. The root cause is a JSON cleanse bypass in the condition.config parameter that allows Yii framework behavior and event configuration keys to survive sanitization and be processed as live object-configuration directives after decoding, yielding arbitrary PHP code execution as the web server user. No CISA KEV listing exists and no confirmed public exploit code has been identified at time of analysis; however, the CVSS 4.0 score of 8.7 with PR:L correctly signals a genuine high-severity finding for any deployment where control panel credentials could be compromised.

HIGH

8.7

1.0%

44

CVE-2026-86732

Remote code execution in Craft CMS before 5.10.12 allows authenticated content editors to achieve full server compromise through a PHP class-injection and log-poisoning chain. By supplying a crafted criteria[withTransforms][0][class] parameter to the element-index endpoint, an attacker forces ImageTransforms::normalizeTransform() to instantiate an arbitrary PHP class; chaining this with yii\rbac\PhpManager - a built-in Yii RBAC component - the attacker can execute PHP payloads previously smuggled into request logs via the User-Agent header. No public exploit tool or CISA KEV listing is identified at time of analysis, but the fully documented multi-stage technique materially lowers the expertise barrier for exploitation.

HIGH

8.7

0.5%

44

CVE-2026-79989

Improper authorization in Craft CMS 5.x allows any authenticated control panel user to change their own password without supplying the current credential or holding an elevated session, and allows users holding the `Edit users` permission to reset other users' passwords - including administrator accounts - enabling full account takeover. The flaw exists in the `elements/save` action, where the `UserPasswordValidator` mass-assigns the `newPassword` field outside of any scenario restriction, bypassing the dedicated `users/set-password` action that enforces elevated session checks. No active exploitation is confirmed (not in CISA KEV); vendor-released patch is available in version 5.10.8.

HIGH

8.7

0.3%

44

CVE-2026-79988

Remote code execution in Craft CMS allows authenticated users with Twig template access to escape the sandbox via permissive Yii framework functionality, achieving full confidentiality, integrity, and availability compromise on the host system. The root cause is CWE-693 (Protection Mechanism Failure): the Twig sandbox policy was configured to permit dangerous Yii framework methods capable of executing arbitrary code, rather than enforcing a tight allowlist. The vendor confirmed and patched this as a high-severity RCE in release 5.10.7; no public exploit code has been confirmed at time of analysis, though a Hackrate hacktivity report exists referencing the issue.

HIGH

8.7

0.3%

44

CVE-2026-79990

GraphQL mutation resolvers in Craft CMS allow a token-authenticated user scoped to Site A to create, modify, or delete content entries in any other site (Site B, Site C, etc.) within the same multi-site installation. The saveEntry and deleteEntry resolvers read siteId directly from user-controlled $arguments without invoking ArgumentManager::prepareArguments(), which performs the critical array_intersect check against the GraphQL schema's allowed-sites list. Query resolvers call prepareArguments() correctly and thus enforce site boundaries, making this a mutation-specific authorization bypass. Craft CMS 5.10.11 ships the fix via the new MutationResolver::requireAllowedSite() guard; no public exploit or CISA KEV listing has been identified at time of analysis.

HIGH

8.7

0.3%

44

CVE-2026-84796

Cross-site authorization bypass in Craft CMS before 5.10.11 allows authenticated GraphQL API token holders to escape their assigned site scope and read, modify, or delete content entries belonging to sites they are not authorized to access. The flaw exists in GraphQL entry mutation resolvers, where ArgumentManager::prepareArguments() accepts a caller-supplied siteId argument without verifying the token's authorization against the requested site. The vendor-released patch at 5.10.11 addresses the issue; no active exploitation or public exploit code has been identified at time of analysis.

HIGH

8.7

0.3%

44

CVE-2026-84801

Privilege escalation in Craft CMS before 5.10.11 allows authenticated non-admin users holding the administrateUsers permission to perform a full control-panel takeover by minting valid password reset URLs for administrator accounts. The actionGetPasswordResetUrl endpoint omits a check that the caller holds admin status, and the downstream actionSetPassword endpoint validates only the cryptographic verification code without inspecting the caller's session - meaning any valid reset token is redeemable regardless of who requested it. No public exploit or KEV listing exists at time of analysis, but the attack is mechanically straightforward for any user who has been delegated the administrateUsers permission.

HIGH

8.7

0.2%

44

CVE-2026-86730

Remote code execution in Craft CMS before 5.10.12 is achievable by any authenticated control-panel user through Yii2 behavior injection. The vulnerability arises because string-typed field-layout elements are not properly cleansed before processing, allowing attackers to embed Yii2 behavior attachments and event handlers in JSON-formatted field-layout tab submissions that bypass validation and reach Craft::createObject(), instantiating arbitrary PHP objects and executing attacker-controlled code. No public exploit code is confirmed and this CVE is not listed in CISA KEV, but the low privilege bar - any control-panel account suffices - elevates real-world risk for organizations with multiple editor or author accounts.

HIGH

8.7

0.4%

44

CVE-2026-79987

Remote code execution in Craft CMS allows any authenticated Control Panel user holding only the minimum `accessCp` permission to execute arbitrary operating system commands as the PHP web worker process. The flaw (GHSA-9c4j-cjw3-r3xx, CWE-470) bypasses the assumption that non-administrative CP users are restricted to content management operations. Vendor-released patch version 5.10.13 is confirmed; no public exploit or CISA KEV listing exists at time of analysis.

HIGH

8.7

0.4%

44

CVE-2026-79991

GraphQL mutation resolvers in Craft CMS allow authenticated users to create, modify, or delete content entries in sites they are not authorized to access. The `saveEntry` and `deleteEntry` resolvers read `siteId` directly from raw `$arguments` without invoking `ArgumentManager::prepareArguments()`, which is the function that enforces per-site scope filtering via `array_intersect`. Because query resolvers invoke this guard but mutation resolvers do not, the multi-site authorization boundary is structurally absent for all write operations. Vendor-released patch is available in version 5.10.13, and no public exploit has been identified at time of analysis.

HIGH

7.1

0.3%

36

CVE-2026-84794

Missing authorization enforcement in Craft CMS's assets/move-asset endpoint allows authenticated low-privilege users to move assets into other users' folders and force-delete conflicting files by supplying the force=1 parameter. Versions 5.0.0 through 5.10.10 are affected; version 5.10.11 resolves the flaw. No public exploit code or active exploitation has been identified at this time, but the low attack complexity and absence of special prerequisites beyond a valid account make exploitation straightforward for any authenticated user.

HIGH

7.1

0.2%

36

CVE-2026-84798

Craft CMS versions 5.0.0-RC1 through 5.10.10 allow an authenticated low-privileged contributor to permanently delete canonical entry content by exploiting a broken authorization chain in ElementsController::actionDeleteForSite(). The method authorizes deletion against the user's provisional draft rather than the canonical element, then propagates the destructive action to the canonical record without re-verifying deleteEntriesForSite permission. Deleted content bypasses the recycle bin and is unrecoverable, making this an integrity-destroying flaw despite its mid-range CVSS score. No public exploit code is identified at time of analysis.

HIGH

7.1

0.2%

36

CVE-2026-84800

Missing authorization in Craft CMS 5.0.0-RC1 through 5.10.10 allows an authenticated low-privilege author to overwrite another user's asset files in shared folders. The flaw in AssetsController::actionReplaceFile occurs because the target asset is resolved by folder and filename after the replacePeerFiles permission check has already executed - omitting the assetId parameter in the request causes the application to silently bypass the peer-replacement gate. The vendor released a fix in version 5.10.11; no public exploit code has been identified at time of analysis.

HIGH

7.1

0.2%

36

CVE-2026-86731

Craft CMS 5.0.0-RC1 through 5.10.11 allows an authenticated control panel user with the `administrateUsers` permission - but without administrator status - to activate pending or deliberately deactivated administrator accounts via the `users/activate-user` action. The `actionActivateUser` method in `UsersController` correctly gates itself behind `administrateUsers` but omits the `requireAdmin()` call that the mirror `actionDeactivateUser` action uses when the target is an administrator, creating an asymmetric authorization implementation. When chained with a password-reset request on the newly activated admin account, a non-admin operator can achieve full administrator control of the CMS. No public exploit identified at time of analysis; the issue is fixed in Craft CMS 5.10.12.

HIGH

7.1

0.2%

36

Severity Breakdown

Monthly CVE Trend

Affected Products (9)

Top Risky CVEs