{"id":"CVE-2026-124429","kind":"vulnerability","aliases":["CVE-2026-124429"],"related":[],"title":"Craft CMS: public registrants can reclaim deactivated accounts with their old permissions","description":"Craft CMS from 5.0.0 before 5.11.2 contains a privilege escalation vulnerability that allows unauthenticated public registrants to reclaim deactivated non-admin accounts while retaining their direct permissions. Attackers can register using a deactivated account, set a new password, and inherit permissions stored in userpermissions_users, enabling privileged account takeover when email verification is disabled.","summary":"Craft CMS from 5.0.0 before 5.11.2 lets an unauthenticated visitor register and reclaim a deactivated non-admin account. The reclaimed account keeps its stored direct permissions, so an attacker can take over a privileged account when email verification is disabled.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["craft-cms","php","runtime","self-hosted"],"not_affected_if":["email-verification-enabled","managed-hosting","registration-disabled"],"how_to_check":"- Check the installed Craft CMS version in `composer.json` or `composer show craftcms/cms`; versions from `5.0.0` up to but not including `5.11.2` are in the affected range.\n- Check whether email verification for public registration is turned off in the Craft control panel user settings.\n- Look for deactivated user accounts that still hold direct permissions in the `userpermissions_users` table.","fix":"- Craft CMS: move to `5.11.2` or later.","status":"open","published_at":"2026-11-08T14:18:08+00:00","first_seen_at":"2026-11-08T14:48:38+00:00","triaged_at":"2026-11-08T14:49:09+00:00","updated_at":"2026-11-08T14:49:09+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-08T14:49:09Z","model":"claude-haiku-5-5","output":{"fix":"- Craft CMS: move to `5.11.2` or later.","reach":"internet","title":"Craft CMS: public registrants can reclaim deactivated accounts with their old permissions","impact":"high","summary":"Craft CMS from 5.0.0 before 5.11.2 lets an unauthenticated visitor register and reclaim a deactivated non-admin account. The reclaimed account keeps its stored direct permissions, so an attacker can take over a privileged account when email verification is disabled.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["craft-cms","php","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker takes over a privileged account and its permissions","analyst_note":"","how_to_check":"- Check the installed Craft CMS version in `composer.json` or `composer show craftcms/cms`; versions from `5.0.0` up to but not including `5.11.2` are in the affected range.\n- Check whether email verification for public registration is turned off in the Craft control panel user settings.\n- Look for deactivated user accounts that still hold direct permissions in the `userpermissions_users` table.","plain_action":"","product_name":"craftcms/cms","needs_analyst":false,"not_affected_if":["registration-disabled","email-verification-enabled","managed-hosting"],"who_is_affected":"Sites running Craft CMS 5.0.0 through 5.10.x that allow public user registration with email verification turned off. Sites with registration closed, email verification enabled, or no deactivated non-admin accounts with direct permissions are much less exposed. Managed hosting that already applies the patched release can skip it.","user_interaction":"no","product_ecosystem":"composer","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000778,"input_tokens":4633,"output_tokens":629,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124429':15A,18A '-2026':14A,17A '5.0.0':30B,71C '5.11.2':32B,73C 'account':8A,45B,48B,62B,90C,102C,116C 'admin':44B,89C 'allow':80C 'attack':56B,96C 'cms':2A,21B,28B,69C 'contain':74C 'craft':1A,20B,27B,68C 'craft-cm':19B 'cve':13A,16A 'deactiv':7A,41B,86C,101C 'direct':52B,94C 'disabl':67B,122C 'email':64B,119C 'enabl':114C 'escal':77C 'host':26B 'inherit':108C 'keep':49B 'let':33B 'new':105C 'non':43B,88C 'non-admin':42B,87C 'old':11A 'password':106C 'permiss':12A,53B,95C,109C 'php':22B 'privileg':61B,76C,115C 'public':3A,82C 'reclaim':6A,39B,47B,85C 'regist':37B,98C 'registr':4A,83C 'retain':92C 'runtim':23B 'self':25B 'self-host':24B 'set':103C 'store':51B,110C 'take':58B 'takeov':117C 'unauthent':35B,81C 'use':99C 'user':113C 'userpermiss':112C 'verif':65B,120C 'visitor':36B 'vulner':78C","nicknames":[],"mitigations":[],"who_affected":"Sites running Craft CMS 5.0.0 through 5.10.x that allow public user registration with email verification turned off. Sites with registration closed, email verification enabled, or no deactivated non-admin accounts with direct permissions are much less exposed. Managed hosting that already applies the patched release can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["craftcms","high","php","runtime","selfhosted"],"campaign_type":null,"search_a":"'-124429':15A,18A '-2026':14A,17A 'account':8A 'cms':2A 'craft':1A 'cve':13A,16A 'deactiv':7A 'old':11A 'permiss':12A 'public':3A 'reclaim':6A 'registr':4A","search_b":"'5.0.0':30B '5.11.2':32B 'account':45B,48B,62B 'admin':44B 'attack':56B 'cms':21B,28B 'craft':20B,27B 'craft-cm':19B 'deactiv':41B 'direct':52B 'disabl':67B 'email':64B 'host':26B 'keep':49B 'let':33B 'non':43B 'non-admin':42B 'permiss':53B 'php':22B 'privileg':61B 'reclaim':39B,47B 'regist':37B 'runtim':23B 'self':25B 'self-host':24B 'store':51B 'take':58B 'unauthent':35B 'verif':65B 'visitor':36B","search_c":"'5.0.0':71C '5.11.2':73C 'account':90C,102C,116C 'admin':89C 'allow':80C 'attack':96C 'cms':69C 'contain':74C 'craft':68C 'deactiv':86C,101C 'direct':94C 'disabl':122C 'email':119C 'enabl':114C 'escal':77C 'inherit':108C 'new':105C 'non':88C 'non-admin':87C 'password':106C 'permiss':95C,109C 'privileg':76C,115C 'public':82C 'reclaim':85C 'regist':98C 'registr':83C 'retain':92C 'set':103C 'store':110C 'takeov':117C 'unauthent':81C 'use':99C 'user':113C 'userpermiss':112C 'verif':120C 'vulner':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-23T09:02:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124429","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124429","severity":null,"published_at":"2026-11-08T14:18:08+00:00","modified_at":"2026-11-08T14:18:08+00:00","first_seen_at":"2026-11-08T14:48:38+00:00","fetched_at":"2026-11-08T14:48:38+00:00","note":null}],"documents":[{"id":102042,"url":"https://github.com/craftcms/cms/security/advisories/GHSA-v25r-wr32-jfg7","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-23T09:02:06+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102043,"url":"https://www.vulncheck.com/advisories/craft-cms-5.0.0-before-5.11.2-privilege-escalation-via-public-registration","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}