Live › vulnerability › CVE-2026-112775
Go to dashboardCraft CMS 5.0.0 to before 5.11.0: for an already active user changing their email, users/verify-email promotes the new address but does not clear the verification code. The same code still works on users/set-password, which does a full password reset. An attacker who got the code from a mailbox, shared inbox or logs can wait for the victim to verify, then reset the password and log in. Preconditions: the attacker must have the code out of band, and the victim must be changing their email. Craft 4.x is not listed as affected.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product |
|---|
| Ecosystem |
|---|
| Affected |
|---|
| Fixed in |
|---|
| craftcms/cms | composer | >= 5.0.0, < 5.11.0 | 5.11.0 |
composer show craftcms/cms or check the version in the control panel footer or composer.lock5.0.0 and < 5.11.0 are affected5.11.0 or later (composer update craftcms/cms)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.
This page as .md · .json · in your agent: get_signal("CVE-2026-112775")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.