CVE-2026-79989 Overview
CVE-2026-79989 is an authorization flaw in Craft CMS that allows authenticated users to change their own password without supplying the current password or maintaining an active elevated session. The flaw also permits accounts holding only the Edit users permission to change other users' passwords, an action that should require the Administrate users permission. The vulnerability is tracked under CWE-285: Improper Authorization and is fixed in Craft CMS 5.10.8.
Critical Impact
Attackers with any authenticated Craft CMS session can hijack accounts by resetting passwords, and users with limited Edit users rights can take over higher-privileged accounts, including administrator accounts.
Affected Products
- Craft CMS versions prior to 5.10.8
- Craft CMS instances exposing the control panel to authenticated users
- Craft CMS deployments granting the Edit users permission to non-administrator roles
Discovery Timeline
- 2026-09-02 - CVE-2026-79989 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-79989
Vulnerability Analysis
The flaw resides in the Craft CMS password change workflow. Craft CMS normally requires a user to confirm their current password or hold an elevated session before password changes are accepted. The vulnerable code path skips both checks, so any authenticated session token is sufficient to overwrite the account password. The impact scales with the compromised account's privileges, up to and including full administrative access.
The second bug is a permission mapping error. Craft CMS separates the ability to edit user profile fields (Edit users) from the ability to change other users' passwords (Administrate users). The vulnerable release routes password change requests through the weaker Edit users permission, letting low-privileged accounts overwrite passwords for accounts they should not control.
Root Cause
The root cause is improper authorization [CWE-285]. The password change endpoint neither validates the current password, verifies an elevated session, nor enforces the correct permission scope when the target user differs from the acting user. The result is a broken access control chain around one of the most sensitive account operations.
Attack Vector
Exploitation requires network access to the Craft CMS control panel and any authenticated user session. An attacker who obtains a foothold on any account can issue a password change request against their own account to persist access, or against another account if they hold Edit users rights. The attacker does not need to know the current password, complete a re-authentication challenge, or interact with the victim.
A detailed technical write-up is available in the HCKRT Hacktivity Report and the GitHub Security Advisory GHSA-p8x7-9vfw-p7vc.
Detection Methods for CVE-2026-79989
Indicators of Compromise
- Password change events in the Craft CMS audit log that lack a preceding elevated-session challenge or current-password confirmation.
- Successful logins from new IP addresses or user agents shortly after an unexplained password change.
- Password changes performed by accounts that hold Edit users but not Administrate users permissions.
- Bulk or rapid password changes across multiple accounts originating from a single session or IP.
Detection Strategies
- Audit Craft CMS users table for passwordResetRequired, lastPasswordChangeDate, and session invalidation events that do not correlate with legitimate user activity.
- Correlate web server access logs for POST requests to the user save and password change endpoints with the acting user's permission set.
- Alert on privilege changes or administrative logins that follow a password change within a short time window.
Monitoring Recommendations
- Forward Craft CMS application logs and web server logs to a centralized SIEM for correlation with authentication telemetry.
- Enable admin change email notifications in Craft CMS so password changes generate an alert to the account owner and security team.
- Baseline normal password change volume per role and alert on deviations, especially from non-administrator roles.
How to Mitigate CVE-2026-79989
Immediate Actions Required
- Upgrade to Craft CMS 5.10.8 or later on all production and staging environments.
- Invalidate all active sessions and force a password reset for administrator and privileged accounts after patching.
- Review the account role assignments and remove Edit users permission from roles that do not require it.
- Review recent password change and login activity for signs of exploitation before patching.
Patch Information
The vendor released a fix in Craft CMS 5.10.8. The patch restores the current-password and elevated-session requirements for self password changes and routes cross-user password changes through the Administrate users permission check. See the Craft CMS 5.10.8 release notes and the Craft CMS repository for source-level details.
Workarounds
- Restrict control panel access to trusted IP ranges using a reverse proxy or web application firewall until the patch is applied.
- Temporarily revoke the Edit users permission from all non-administrator roles to eliminate the cross-user attack path.
- Enforce short session lifetimes and require re-authentication for control panel access to reduce the window for session abuse.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.