{"id":"CVE-2026-112775","kind":"vulnerability","aliases":["CVE-2026-112775"],"related":[],"title":"Craft CMS: reused email verification codes let attackers reset passwords and take over accounts","description":"Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.","summary":"Craft CMS 5.0.0 to before 5.11.0: for an already active user changing their email, users/verify-email promotes the new address but does not clear the verification code. The same code still works on users/set-password, which does a full password reset. An attacker who got the code from a mailbox, shared inbox or logs can wait for the victim to verify, then reset the password and log in. Preconditions: the attacker must have the code out of band, and the victim must be changing their email. Craft 4.x is not listed as affected.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"craftcms/cms","fixed":["5.11.0"],"affected":">= 5.0.0, < 5.11.0","ecosystem":"composer"}],"ecosystems":[],"tags":["craft-cms","php","runtime","self-hosted"],"not_affected_if":["default-config","managed-hosting"],"how_to_check":"Run 'composer show craftcms/cms' or check the version in the control panel footer or composer.lock. Versions >= 5.0.0 and < 5.11.0 are affected.","fix":"Upgrade craftcms/cms to 5.11.0 or later (composer update craftcms/cms). The vendor lists no workaround.","status":"open","published_at":"2026-10-19T20:17:54+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-23T22:37:28+00:00","updated_at":"2026-10-24T00:20:12+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-10-23T22:37:28Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Craft CMS to 5.11.0 or later.","reach":"internet","title":"Craft CMS: reused email verification codes let attackers reset passwords and take over accounts","impact":"high","summary":"Craft CMS versions 5.0.0 through 5.11.0 do not invalidate email verification codes after use for active users. An attacker who obtains a victim's emailed code can reuse it on the set-password endpoint to reset the password and take over the account.","category":"runtime","who_cares":["craft-cms","php","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker takes over a user account by resetting its password.","analyst_note":"Check the Craft CMS 5.11.0 release notes and advisory for exact exposure details and any workaround; the sources do not say whether an attacker needs to already hold a session or a valid account first.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000481,"input_tokens":2937,"output_tokens":374,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Craft CMS 5.11.0 release notes and advisory for exact exposure details and any workaround; the sources do not say whether an attacker needs to already hold a session or a valid account first.","search":"'-112775':17A,20A '-2026':16A,19A '4':115B '5.0.0':32B,125C '5.11.0':35B,127C 'account':14A,176C 'activ':39B,147C 'address':48B 'affect':121B 'allow':134C 'alreadi':38B 'attack':8A,70B,98B,135C,149C 'authent':130C 'band':105B 'bypass':131C 'chang':41B,111B,168C 'clear':52B 'cms':2A,24B,31B,123C 'code':6A,55B,58B,74B,102B,139C,156C 'contain':128C 'craft':1A,23B,30B,114B,122C 'craft-cm':22B 'craftcms/cms':21A 'cve':15A,18A 'email':4A,43B,113B,155C,167C 'full':66B 'got':72B 'host':29B 'inbox':79B 'invalid':144C 'let':7A 'list':119B 'log':81B,94B 'mailbox':77B 'must':99B,109B 'new':47B 'obtain':151C 'password':10A,67B,92B,171C 'php':25B 'precondit':96B 'promot':45B 'reset':9A,68B,90B,169C 'reus':3A,137C 'runtim':26B 'self':28B 'self-host':27B 'share':78B 'still':59B 'submit':158C 'take':12A,173C 'user':40B,148C 'users/set-password':62B,161C 'users/verify-email':44B,141C 'verif':5A,54B,138C 'verifi':88B,165C 'victim':86B,108B,153C,164C 'vulner':132C 'wait':83B 'work':60B 'x':116B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T20:17:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112775","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112775","severity":null,"published_at":"2026-10-19T20:17:54+00:00","modified_at":"2026-10-22T21:17:16+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112775:637","url":null,"severity":null,"published_at":"2026-10-24T00:20:12+00:00","modified_at":"2026-10-24T00:20:12+00:00","first_seen_at":"2026-10-24T00:20:12+00:00","fetched_at":"2026-10-24T00:20:12+00:00","note":"Vendor advisory GHSA-xh42-494x-2xgv + 5.11.0 release notes read. Vendor rates Moderate (NVD/VulnCheck 7.5/8.7); attacker needs the emailed code out of band and an active user doing an email change; no workaround published; no PoC or exploitation found; did not search social."}],"documents":[{"id":2548,"url":"https://github.com/craftcms/cms/security/advisories/GHSA-xh42-494x-2xgv","title":"Craft CMS GHSA-xh42-494x-2xgv: verification code survives verify-email","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2549,"url":"https://github.com/craftcms/cms/releases/tag/5.11.0","title":"Craft CMS 5.11.0 release notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}