VulnerabilityPublished 6 Aug 2026

craftcms/cms · Craft CMS: Arbitrary user password reset leading to administrator account takeover

Affects craftcms/cmsSource GCVE Database

Severity

High

Rated by Threat Radar

Patch: Available – fixed in 5.10.8

Data as of 7 Aug 2026, 06:26 UTC

What to do

Upgrade craftcms/cms to 5.10.8.

Affected software

Product	Affected	Fixed in
Packagistcraftcms/cms	Affected >=5.0.0-RC1 <5.10.8	Fixed in 5.10.8

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A patch is available to address this vulnerability. It is recommended to apply the official fix provided by the vendor to ensure that password changes require proper verification and elevated session checks. Until patched, restrict 'Edit users' permissions to trusted users only and monitor for suspicious password changes. Patch status is confirmed as available; apply updates promptly.

Description

Craft CMS contains a vulnerability that allows any authenticated user to change their own password without providing the current password or having an elevated session. Additionally, users with the 'Edit users' permission can change other users' passwords, including administrators, despite lacking the 'Administrate users' permission. This flaw exists due to improper validation in the user password update process, bypassing intended security checks.

Impact

Any authenticated user can change their own password without needing to provide the current password, potentially allowing account takeover if the session is hijacked or compromised. Users with the 'Edit users' permission can change any user's password, including administrators, enabling privilege escalation and full account takeover of high-privilege accounts.

Summary

The vulnerability in Craft CMS arises from the 'elements/save' action when saving a User element. The 'UserPasswordValidator' applies only a 'safe' validator to the 'newPassword' field without restricting it to specific scenarios, making 'newPassword' mass-assignable during the generic element save flow. This bypasses the dedicated 'users/set-password' action that enforces elevated session verification. Consequently, any authenticated user can change their own password without providing the current password. Furthermore, users with the 'Edit users' permission can change other users' passwords, including administrators, even though they lack the 'Administrate users' permission required for such actions.

CWE-285Improper Authorization (opens in a new tab)
Class weaknessLikelihood of exploit: HighOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries.
Architecture and Design
Ensure that you perform access control checks related to your business logic. These checks may be different than the access control checks that you apply to more generic resources such as files, connections, processes, memory, and database records.
Architecture and Design · Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
OWASP Cheat Sheets
Authorization (opens in a new tab)
OWASP ASVS 4.0.3
V8.3.8 (opens in a new tab)
V13.4.2 (opens in a new tab)
V7.2.2 (opens in a new tab)
Attack patterns
Accessing Functionality Not Properly Constrained by ACLs (opens in a new tab)
Cross Zone Scripting (opens in a new tab)
Directory Indexing (opens in a new tab)
Subverting Environment Variable Values (opens in a new tab)
Using Malicious Files (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Aug 2026, 06:26 UTC

WeaknessesCWE-285

Technical details

References

Community reviews

Related threats