CVE-2026-112775: Improper Authentication in craftcms cms

CVE-2026-112775 is an authentication bypass vulnerability in Craft CMS affecting versions >=5.0.0 and <5.11.0. The vulnerability arises because the users/verify-email endpoint fails to invalidate verification codes for active users, allowing reuse of these codes. An attacker who intercepts or obtains a victim's verification code sent by email can submit it to the users/set-password endpoint after the victim verifies an email change, thereby resetting the password and taking over the account. The CVSS 4.0 score is 8.7 (high severity), indicating network attack vector with low complexity and no privileges or user interaction required.

Successful exploitation allows an attacker to bypass authentication controls by reusing verification codes, enabling password reset and full account takeover without needing prior access or user interaction. This compromises user accounts and potentially sensitive data within the affected Craft CMS installation.

A fix is available in Craft CMS version 5.11.0 and later. Users should upgrade to version 5.11.0 or above to remediate this vulnerability. No vendor advisory content was provided to indicate alternative mitigations or temporary fixes.