CVE-2026-86731: Missing Authorization in craftcms cms

Craft CMS versions from 5.0.0-RC1 up to but not including 5.10.12 have a missing admin-target guard in the UsersController::actionActivateUser method. Although the action requires the administrateUsers permission, it does not enforce requireAdmin() when the targeted user is an administrator, unlike the corresponding deactivate action. This allows a non-administrator user with administrateUsers permission to activate a pending or deactivated administrator account, potentially escalating privileges when combined with password reset capabilities. The issue is resolved in Craft CMS 5.10.12.

An authenticated control panel user with the administrateUsers permission but without administrator privileges can activate administrator accounts. This can lead to privilege escalation if the attacker also resets the administrator account's password, potentially gaining full administrative control over the CMS.

Upgrade Craft CMS to version 5.10.12 or later, where this authorization issue has been fixed. Until the update is applied, restrict the administrateUsers permission to trusted administrators only to minimize risk.