CVE-2026-84795: Improper Privilege Management in craftcms cms

CVE-2026-84795 affects Craft CMS before version 5.10.11. The vulnerability arises because the system fails to validate the admin flag during user registration, allowing the flag to persist from deactivated admin accounts. This enables an attacker to register with the email address of a deactivated administrator and inherit administrator privileges, provided that public registration is enabled and email verification is disabled. This is an improper privilege management issue that can lead to unauthorized administrative access.

Successful exploitation allows an attacker to gain administrator privileges in the affected Craft CMS installation by registering with the email address of a deactivated admin account. This can lead to full administrative control over the CMS, potentially compromising the confidentiality, integrity, and availability of the system and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider disabling public registration or enabling email verification to mitigate the risk of unauthorized privilege escalation via this vulnerability.