CVE-2026-84801: Craft CMS Auth Bypass Vulnerability

CVE-2026-84801 Overview

CVE-2026-84801 is an authentication bypass vulnerability in Craft CMS versions before 5.10.11. The flaw resides in the actionGetPasswordResetUrl endpoint, which fails to validate whether the requesting user holds administrator status. Any non-admin user granted the administrateUsers permission can mint a password reset URL for an administrator account. The companion actionSetPassword endpoint validates only the verification code and does not check the caller's session, allowing the attacker to set a new password and take over the target admin account. This weakness is classified as Missing Authorization [CWE-862].

Critical Impact
A low-privileged user with administrateUsers permission can seize full administrator control of the Craft CMS control panel, achieving complete takeover of the application.

Affected Products

Craft CMS versions 5.0.0-rc1 through 5.10.10
Craft CMS installations where non-admin roles are granted the administrateUsers permission
Craft CMS control panel component

Discovery Timeline

2026-09-02 - CVE-2026-84801 published to the National Vulnerability Database (NVD)
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84801

Vulnerability Analysis

Craft CMS separates user management responsibilities from full administrator status. The administrateUsers permission is intended to let trusted operators create, edit, and manage standard user accounts. The actionGetPasswordResetUrl controller action was expected to gate administrator-account resets behind an admin-status check, but that check is missing. As a result, the authorization boundary between user managers and administrators collapses.

An attacker with administrateUsers permission calls the endpoint and requests a reset URL for a target user ID that belongs to an administrator. Craft CMS returns a valid, signed reset URL containing a verification code tied to the admin account. The attacker then submits that verification code to actionSetPassword along with a chosen new password.

Because actionSetPassword treats a valid verification code as sufficient proof of identity and does not correlate the request with the caller's authenticated session, the password change succeeds. The attacker authenticates as the administrator and gains full control-panel access.

Root Cause

The root cause is a missing authorization check in actionGetPasswordResetUrl. The controller trusts the administrateUsers permission for all target accounts rather than requiring administrator status when the target is an administrator. This is a classic [CWE-862] Missing Authorization defect, compounded by actionSetPassword relying solely on the verification code rather than binding password resets to the initiating session.

Attack Vector

The attack is remote and requires an authenticated session with the administrateUsers permission. No user interaction from the administrator is required. The exploit path is:

The attacker authenticates to Craft CMS with an account holding administrateUsers.
The attacker calls actionGetPasswordResetUrl supplying an administrator's user ID.
Craft CMS returns a valid password reset URL for that administrator.
The attacker submits the embedded verification code to actionSetPassword with a chosen password.
The attacker logs in as the administrator and controls the control panel.

For technical details, see the GitHub Security Advisory GHSA-6qw4-cjqw-fj72 and the VulnCheck Advisory for Craft CMS Authentication Bypass.

Detection Methods for CVE-2026-84801

Indicators of Compromise

Requests to actions/users/get-password-reset-url originating from non-administrator sessions in Craft CMS access logs.
Requests to actions/users/set-password where the associated reset URL was minted for an administrator account.
Unexpected password changes on administrator accounts followed by control-panel logins from new IP addresses or user agents.
Creation of new administrator accounts, plugin installations, or template edits shortly after a suspicious password reset event.

Detection Strategies

Audit web server and application logs for actionGetPasswordResetUrl invocations correlated with the requesting user ID and the target user ID.
Alert whenever an account without administrator status requests reset URLs for administrator accounts.
Correlate actionSetPassword requests with the session that originally requested the reset URL to identify session mismatches.
Review Craft CMS activity logs and database audit trails for administrator password changes not initiated by the administrator.

Monitoring Recommendations

Enable verbose logging on Craft CMS authentication and user-management endpoints and forward events to a centralized SIEM.
Establish a baseline of legitimate administrateUsers operators and alert on privilege escalations from those accounts.
Monitor for administrator logins from new geographies, IP ranges, or devices immediately following password reset activity.

How to Mitigate CVE-2026-84801

Immediate Actions Required

Upgrade Craft CMS to version 5.10.11 or later, which adds the missing admin-status validation in actionGetPasswordResetUrl.
Inventory all user groups and roles that hold the administrateUsers permission and remove it from any account that does not strictly require it.
Rotate passwords and session tokens for all administrator accounts after patching to invalidate any reset URLs that may have been minted pre-patch.
Review recent administrator account activity for unauthorized password changes, logins, or configuration edits.

Patch Information

Pistachio Craft CMS 5.10.11 remediates CVE-2026-84801 by validating administrator status inside actionGetPasswordResetUrl before issuing reset URLs for admin accounts. Upgrade instructions and full details are available in the GitHub Security Advisory GHSA-6qw4-cjqw-fj72. Operators running any release from 5.0.0-rc1 through 5.10.10 must upgrade.

Workarounds

Revoke the administrateUsers permission from all non-administrator user groups until the upgrade to 5.10.11 is complete.
Restrict access to the Craft CMS control panel at the network layer, permitting connections only from trusted management IP ranges.
Enforce multi-factor authentication for administrator accounts to add a second control that a stolen password cannot bypass.
Temporarily disable password reset functionality via reverse proxy rules that block actions/users/get-password-reset-url requests from non-admin sessions.