Craft CMS versions 5.0.0-RC1 through 5.10.11 lack an admin-target guard in the UsersController::actionActivateUser method. Although the action requires the administrateUsers permission, it does not enforce requireAdmin() when the targeted user is an administrator, unlike the similar actionDeactivateUser method. This allows a non-administrator user with administrateUsers permission to activate administrator accounts that are pending or deactivated, potentially enabling privilege escalation if the attacker can reset the administrator's password. The issue is resolved in Craft CMS 5.10.12.

An authenticated control panel user with the administrateUsers permission but without administrator privileges can activate administrator accounts that are pending or deactivated. This can lead to permission escalation, especially if combined with resetting the administrator account's password, potentially granting the attacker full administrative control.

Upgrade Craft CMS to version 5.10.12 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated in the available data.