CVE-2026-84801: Missing Authorization in craftcms cms

Craft CMS versions prior to 5.10.11 fail to properly validate administrative status in the actionGetPasswordResetUrl endpoint. Non-admin users who have the administrateUsers permission can generate valid password reset URLs for any administrator account. The subsequent actionSetPassword endpoint only validates the verification code and does not verify the caller's session, allowing attackers to reset the password and gain complete control over the admin account and control panel.

An attacker with the administrateUsers permission can bypass intended authorization checks to reset passwords for administrator accounts. This results in a complete compromise of the control panel, enabling unauthorized administrative access and potential full system control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the administrateUsers permission to fully trusted users only and monitor for suspicious password reset activity involving administrator accounts.