---
id: "CVE-2026-112775"
kind: "vulnerability"
aliases: ["CVE-2026-112775"]
title: "Craft CMS: reused email verification codes let attackers reset passwords and take over accounts"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "craftcms/cms", "fixed": ["5.11.0"], "affected": ">= 5.0.0, < 5.11.0", "ecosystem": "composer"}]
ecosystems: []
tags: ["craft-cms", "php", "runtime", "self-hosted"]
not_affected_if: ["default-config", "managed-hosting"]
published_at: "2026-10-19T20:17:54+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-24T00:20:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112775", "first_seen_at": "2026-10-23T21:57:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:20:12+00:00"}]
---

# Craft CMS: reused email verification codes let attackers reset passwords and take over accounts

Craft CMS 5.0.0 to before 5.11.0: for an already active user changing their email, users/verify-email promotes the new address but does not clear the verification code. The same code still works on users/set-password, which does a full password reset. An attacker who got the code from a mailbox, shared inbox or logs can wait for the victim to verify, then reset the password and log in. Preconditions: the attacker must have the code out of band, and the victim must be changing their email. Craft 4.x is not listed as affected.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:craftcms/cms affected >= 5.0.0, < 5.11.0 fixed 5.11.0

## How to check

Run 'composer show craftcms/cms' or check the version in the control panel footer or composer.lock. Versions >= 5.0.0 and < 5.11.0 are affected.

## Fix

Upgrade craftcms/cms to 5.11.0 or later (composer update craftcms/cms). The vendor lists no workaround.

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112775
- 2026-10-24T00:20:12+00:00 analyst — Vendor advisory GHSA-xh42-494x-2xgv + 5.11.0 release notes read. Vendor rates Moderate (NVD/VulnCheck 7.5/8.7); attacker needs the emailed code out of band and an active user doing an email change; no workaround published; no PoC or exploitation found; did not search social.

## Documents

- [advisory] Craft CMS GHSA-xh42-494x-2xgv: verification code survives verify-email https://github.com/craftcms/cms/security/advisories/GHSA-xh42-494x-2xgv
- [fix] Craft CMS 5.11.0 release notes https://github.com/craftcms/cms/releases/tag/5.11.0

## From the sources

Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obtain a victim's emailed code can submit it to users/set-password after the victim verifies an email change, resetting the password and taking over the account.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_