CVE-2026-124429 · Runtime
NO FIX YET · SEE WHAT TO DO
Craft CMS from 5.0.0 before 5.11.2 lets an unauthenticated visitor register and reclaim a deactivated non-admin account. The reclaimed account keeps its stored direct permissions, so an attacker can take over a privileged account when email verification is disabled.
first public Oct 23, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running Craft CMS 5.0.0 through 5.10.x that allow public user registration with email verification turned off. Sites with registration closed, email verification enabled, or no deactivated non-admin accounts with direct permissions are much less exposed. Managed hosting that already applies the patched release can skip it.
Not affected if email-verification-enabled, managed-hosting, registration-disabled
Who cares craft-cms, php, self-hosted
composer.json or composer show craftcms/cms; versions from 5.0.0 up to but not including 5.11.2 are in the affected range.userpermissions_users table.5.11.2 or later.Craft CMS from 5.0.0 before 5.11.2 contains a privilege escalation vulnerability that allows unauthenticated public registrants to reclaim deactivated non-admin accounts while retaining their direct permissions. Attackers can register using a deactivated account, set a new password, and inherit permissions stored in userpermissions_users, enabling privileged account takeover when email verification is disabled.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.