CVE-2026-72786: Craft CMS Auth Bypass Vulnerability

CVE-2026-72786 Overview

CVE-2026-72786 is an authentication bypass vulnerability in Craft CMS versions before 5.10.8. The flaw resides in the elements/save action, which fails to validate the current password before accepting a newPassword value in the User element save flow. Authenticated users with the edit users permission can reset the password of any account, including administrator accounts, without knowing the existing credentials. The issue is categorized under CWE-285: Improper Authorization.

Critical Impact
A low-privileged authenticated user with edit users permission can take over administrator accounts by silently resetting their passwords, leading to full application compromise.

Affected Products

Craft CMS versions prior to 5.10.8
Craft CMS 5.x release line (including release candidates before the fixed build)
Any deployment granting non-admin users the edit users permission

Discovery Timeline

2026-08-12 - CVE-2026-72786 published to the National Vulnerability Database (NVD)
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-72786

Vulnerability Analysis

Craft CMS exposes an elements/save controller action that persists changes to element models, including User elements. The action accepts a newPassword field but does not enforce the same current-password verification required by the standard user account management screens. Because the check is missing at the controller layer, the password change is applied unconditionally when the requesting user has permission to edit the target user.

An attacker only needs an authenticated session with the edit users permission. That permission is commonly granted to editorial, HR, or support roles, none of which are expected to have administrative reach. By submitting a crafted save request against an administrator's User element, the attacker can overwrite the administrator's password hash and then log in with the new credentials.

The vulnerability breaks the authorization boundary that separates content management roles from account ownership. It is a pure authorization defect: the request itself is well-formed, but the server does not enforce the additional identity proof required to change credentials.

Root Cause

The root cause is missing authorization logic in the User element save flow. The newPassword attribute is processed as a normal element field rather than a security-sensitive credential change, so the code path that would normally require re-authentication or a password reset token is bypassed.

Attack Vector

Exploitation is performed over the network against the Craft CMS control panel. The attacker authenticates as a low-privileged user holding the edit users permission, then issues a POST request to the elements/save endpoint targeting an administrator's user ID with a newPassword parameter. See the GitHub Security Advisory GHSA-p8x7-9vfw-p7vc and the VulnCheck advisory for the request structure and affected code path.

Detection Methods for CVE-2026-72786

Indicators of Compromise

POST requests to elements/save that include a newPassword field targeting a user ID other than the requester's own account
Successful administrator logins from IP addresses or user agents previously associated only with non-admin accounts
Audit log entries showing password changes for administrator accounts without a preceding password-reset email or token request

Detection Strategies

Review Craft CMS web server access logs for requests to the elements/save action that carry newPassword parameters and correlate the acting user against the target user ID
Alert when a non-admin session modifies an admin User element, especially when credential fields are present in the payload
Compare the timestamps of password changes against the Craft CMS activity log to identify changes not initiated through the standard account settings screen

Monitoring Recommendations

Forward Craft CMS application logs and web access logs to a centralized SIEM or data lake for retention and correlation
Baseline normal usage of the edit users permission and flag deviations, including bulk edits against privileged accounts
Monitor for administrator logins that immediately follow a password change event and validate them against helpdesk or ticketing records

How to Mitigate CVE-2026-72786

Immediate Actions Required

Upgrade all Craft CMS instances to version 5.10.8 or later
Audit which roles hold the edit users permission and remove it from accounts that do not require it
Force a password reset for administrator accounts and review recent password-change events for anomalies
Rotate API keys, session tokens, and integration credentials tied to any account suspected of compromise

Patch Information

Craft CMS 5.10.8 introduces the fix that enforces proper authorization on the elements/save action so that the newPassword field is no longer honored without the required credential verification. Refer to the GitHub Security Advisory GHSA-p8x7-9vfw-p7vc for the commit references and the full list of fixed versions.

Workarounds

Restrict the edit users permission to trusted administrators until the upgrade is applied
Place the Craft CMS control panel behind a VPN, IP allowlist, or reverse-proxy authentication layer to reduce the attack surface
Enable multi-factor authentication for all administrator accounts so that a stolen password alone is insufficient for takeover

bash

# Verify the running Craft CMS version and upgrade via Composer
php craft --version
composer require craftcms/cms:^5.10.8 -w
php craft up