CVE-2026-79989: CWE-285 Improper Authorization in craftcms cms

This vulnerability in CraftCMS (version 5.0.0-RC1) involves improper authorization (CWE-285) where authenticated users can change their own passwords without verifying the current password or elevated privileges. Furthermore, users with 'Edit users' permission can change other users' passwords even though they lack the 'Administrate users' permission, which should be required for such changes. This flaw could lead to unauthorized password changes, potentially enabling account takeover or privilege escalation within the CMS.

The vulnerability allows unauthorized password changes by authenticated users, undermining access controls. Attackers can change their own passwords without current password verification, and users with limited permissions can change other users' passwords, potentially leading to unauthorized account access and privilege escalation. This compromises the integrity and security of user accounts within the affected CraftCMS instance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user permissions carefully, especially the 'Edit users' permission, and monitor for suspicious password changes. Avoid granting unnecessary permissions to users to limit exploitation potential.