Threats tagged 'ghsa-fxv4-ghmc-845p'

Craft CMS versions from 5.0.0 up to but not including 5.11.2 contain a privilege escalation vulnerability that allows unauthenticated public registrants to reclaim deactivated non-admin accounts and retain their direct permissions. This occurs when email verification is disabled, enabling attackers to set a new password for a deactivated account and inherit its permissions, potentially leading to privileged account takeover.