CVE-2026-84795: Craft CMS Authentication Bypass Vulnerability

CVE-2026-84795 Overview

Craft CMS versions before 5.10.11 contain an authentication bypass vulnerability in the user registration workflow. The application fails to validate the admin flag during registration, allowing the flag to persist from deactivated administrator accounts. An attacker who registers a new account using the email address of a previously deactivated admin inherits full administrator privileges. Exploitation requires that public registration is enabled and email verification is disabled on the target site. The flaw is tracked under CWE-269: Improper Privilege Management and affects sites using vulnerable configurations of Craft CMS.

Critical Impact
Unauthenticated attackers gain full administrator access to Craft CMS instances by re-registering deactivated admin email addresses.

Affected Products

Craft CMS versions prior to 5.10.11
Craft CMS installations with public user registration enabled
Craft CMS installations with email verification disabled

Discovery Timeline

2026-09-02 - CVE-2026-84795 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84795

Vulnerability Analysis

The vulnerability stems from improper state handling in Craft CMS user registration. When an administrator account is deactivated, the underlying user record retains the admin flag associated with the email address. The registration handler does not reset or validate this flag when a new account is created against the same identifier. As a result, the newly registered user reuses the persisted admin privilege state and gains elevated access.

This is a privilege management flaw classified as CWE-269. It requires no authentication and no user interaction from a victim. Two configuration prerequisites must be present on the target: public registration must be enabled, and email verification must be disabled. Both are supported first-class options in Craft CMS and appear in real-world deployments where self-service signup is required.

Root Cause

The root cause is a missing authorization check during account creation. The registration workflow trusts residual user state tied to the email address instead of enforcing a default non-privileged role for newly registered accounts. Deactivation removes access but does not clear the admin attribute, so the attribute is inherited by any subsequent registration using the same email.

Attack Vector

An attacker enumerates or discovers the email address of a former administrator. Using the public registration form, the attacker submits a new account request with that email address. Because email verification is disabled, the account is created immediately with the persisted admin flag intact. The attacker then authenticates and accesses the Craft CMS control panel with full administrative rights.

The vulnerability manifests during the registration handler's user creation logic. Refer to the GitHub Security Advisory GHSA-242m-9wq7-vhwq and the VulnCheck Advisory for additional technical detail.

Detection Methods for CVE-2026-84795

Indicators of Compromise

New user accounts in the Craft CMS users table that carry the admin flag but were created after an admin account with the same email was deactivated.
Successful control panel logins from accounts recently created through the public registration endpoint.
Registration events using email addresses that previously belonged to deactivated administrators.

Detection Strategies

Audit the Craft CMS user database for any account where admin = 1 and the dateCreated timestamp is later than the deactivation date of a prior admin with the same email.
Review web server logs for POST requests to the Craft CMS registration endpoint followed by successful authentication to /admin or the configured control panel path.
Correlate registration events with subsequent privilege-sensitive actions such as plugin installation, user role changes, or template edits.

Monitoring Recommendations

Alert on any newly created account that holds administrator privileges without an explicit provisioning workflow.
Monitor Craft CMS application logs for registration activity targeting email addresses that appear in historical admin audit records.
Track control panel access patterns and flag first-time administrative logins from newly registered accounts.

How to Mitigate CVE-2026-84795

Immediate Actions Required

Upgrade Craft CMS to version 5.10.11 or later on all affected installations.
Audit existing user accounts for unexpected admin privileges and revoke any that cannot be justified.
Disable public user registration until the patch is applied if administrative email addresses have ever been deactivated.

Patch Information

Craft CMS 5.10.11 fixes the flaw by validating the admin flag during registration so that it cannot be inherited from a deactivated account. Upgrade instructions and the full fix description are available in the Craft CMS Security Advisory GHSA-242m-9wq7-vhwq.

Workarounds

Enable email verification for new user registrations so that account creation cannot complete without control of the target inbox.
Disable public user registration entirely on production sites that do not require self-service signup.
Delete rather than deactivate former administrator accounts to remove the persisted admin attribute from the user record.

bash

# Verify the installed Craft CMS version and upgrade via Composer
php craft --version
composer require craftcms/cms:^5.10.11 -w
php craft up